Edit tour

Windows Analysis Report
https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA8

Overview

General Information

Sample URL:	https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2V
Analysis ID:	1538314
Tags:	urlscan
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,1523407136651421618,18002775958250013191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53185 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.8:59265 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.8:53171 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D HTTP/1.1Host: es.research.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1Host: es.research.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: es.research.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53174
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53177
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53185
Source: unknown	Network traffic detected: HTTP traffic on port 53176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 53182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 53177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59268
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59266
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:53185 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/6@6/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,1523407136651421618,18002775958250013191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,1523407136651421618,18002775958250013191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d2yx97y2ukjhui.cloudfront.net	18.244.18.6	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www.google.com	142.250.186.100	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
es.research.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D	false		unknown
https://es.research.net/user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.244.18.42	unknown	United States	16509	AMAZON-02US	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
18.244.18.6	d2yx97y2ukjhui.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.8
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538314
Start date and time:	2024-10-21 00:18:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/6@6/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.184.238, 74.125.133.84, 199.232.210.172, 52.165.164.15, 40.69.42.241, 142.250.186.99, 216.58.212.131, 34.104.35.123, 192.229.221.95, 2.19.126.137, 2.19.126.163
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 20 21:20:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987212472133119
Encrypted:	false
SSDEEP:	48:8T0d0jTs4yfHLZidAKZdA1oehwiZUklqehiy+3:8TzjPympy
MD5:	A0260C80865278B6264B49228D0A69AE
SHA1:	78C6AA60ECDFC761D88994FFB6919E7473F32439
SHA-256:	969C25A20F0B702B24ADD204997DDC780EB7E5D4C107F36316C3F2969DB53525
SHA-512:	16A81AF3EAAA5C2E146BC7F1A8972E6AA67164AA742D33BCFB579F0B4E5BC35664FF91F7FC520646217CC8692F292DB0D30EEA554D83CB12E0A409ED5A893F55
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....3.3>#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 20 21:19:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001519855141531
Encrypted:	false
SSDEEP:	48:880d0jTs4yfHLZidAKZdA1leh/iZUkAQkqehZy+2:88zjPyk9Qsy
MD5:	955C59431EDC9F022C9D77E4F1019947
SHA1:	EE46EB10C3E5F9E7A097ECDA588E3E34093B743D
SHA-256:	06CF1EFD8F83FE74F6B36B284D928B7C299E8623DA83B1AF5363AA202F82B603
SHA-512:	CC96DDFC18F27E19B0159CF997A7E61C838876834866D4E03841D433E44FB69E35A194C4EF2A4B13DCE527C46643B5BD29A5548F91C5CDF33F92A84CD4D0538F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......3>#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012151934556747
Encrypted:	false
SSDEEP:	48:8N0d0jTs4bHLZidAKZdA14t5eh7sFiZUkmgqeh7sLy+BX:8NzjPwndy
MD5:	8FE5911761BF2E1F472972702B8AB8B2
SHA1:	56E77AD7B0B95C88BE6534E26E578AA280284DD2
SHA-256:	561684F19C378F0E7EF12EFB768C9B60B6AC51AA7F22BCA71469160732806994
SHA-512:	149369D4733C86EEAF709B7E95FE7C0911E8CC7615440DA30D796D0BE4E6ADAFD04C22007212E9A396CD0AA653DCF54880F2085D5F7BA5F82D40CDAE254E87B7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 20 21:19:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.0000360735224145
Encrypted:	false
SSDEEP:	48:8Cd0d0jTs4yfHLZidAKZdA16ehDiZUkwqehFy+R:8CdzjPy/Ty
MD5:	5D5B2C2966223F8A8350C25FDB7F9889
SHA1:	6652C17EFD5401A34E9D0B3B86CF1670A1D419A2
SHA-256:	78AEB3C204BCB95371F9178882DEA915C09275CDABA443AB11D8154E2663249C
SHA-512:	B816DA0C8C56AE83E988ECA75E93DC45C98A1F920354FA163C6FA9C1D81C7D881F6EEF08E3FA2856D6055A938167804C2A7B4DF8EB27144DFFB67BD28E11D9F1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......3>#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 20 21:20:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9902663524579647
Encrypted:	false
SSDEEP:	48:8Z0d0jTs4yfHLZidAKZdA1UehBiZUk1W1qehPy+C:8ZzjPyf9vy
MD5:	BC4458F8EA679F425A9F72F450D75441
SHA1:	2ED5E6EB7FD50BB9C0C3A6E0847CC68B995CF5E0
SHA-256:	66C3F4A77703E45A14EC9D9B2B374A2EB98C41D4A2C519F5D9174364A5859E55
SHA-512:	F1E5FBB0AEDCF2F6F0586AF8B6988350D55EA3B22B938951C713E13C20D5643FDD2C083EBF9FE62B6F4CC30DD06F1E0B8FDF095A401930339759A3285192291B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......3>#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 20 21:19:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.998566833530272
Encrypted:	false
SSDEEP:	48:8k0d0jTs4yfHLZidAKZdA1duTrehOuTbbiZUk5OjqehOuTbdy+yT+:8kzjPyYTYTbxWOvTbdy7T
MD5:	E8A8BA34DADF15774E8E0A66D5BDAD57
SHA1:	B99BF096CBC01A2025C758F2E0879A0E842B0BA3
SHA-256:	236CBAB3EAE9AE24EC5F51576588E18C0270B44C26BC0344F54511E8D8A85121
SHA-512:	272EC7FE61E5C2EC15FA870EB2D08AF24935446567CF09DDE7CA0E8FEB233F39370FFC0C9EC1D22842C8753DB2E2625D03FC587DFAB8EEB94C51FD5931120B9B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....}..3>#..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ITY\|.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTY\|.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTY\|.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTY\|............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............#......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 00:19:48.893085957 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:48.896889925 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:48.899025917 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:48.901048899 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:48.901113987 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:48.902896881 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:48.907707930 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.044080973 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.044107914 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.044125080 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.044193983 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.045263052 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.045337915 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.047355890 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.047487020 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.047952890 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.052289009 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.060537100 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.061594963 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.061669111 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.062751055 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.063421011 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.068219900 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.202984095 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.203005075 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.203111887 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.203351974 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.203583956 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.203656912 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.206192017 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.206285000 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.206492901 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.211585045 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.221745014 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.222148895 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.222215891 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.224510908 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.224606037 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.229902029 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.366894960 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.366914988 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.366931915 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.367007017 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.367017984 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.367079020 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.370353937 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.370448112 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.370637894 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.376197100 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.381300926 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.381858110 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.381938934 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.384438038 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.384524107 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.390264034 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.527638912 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.527678013 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.527760029 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.527843952 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.528134108 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.528202057 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.531089067 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.531198978 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.531395912 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.837171078 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.905419111 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.905515909 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.905596972 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.905837059 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.905888081 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.908361912 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.908437014 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.908662081 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.908698082 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:49.911101103 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.915374041 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.915404081 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:49.946566105 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 21, 2024 00:19:50.063167095 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.063493013 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.063544035 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.063568115 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.063911915 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.063968897 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.066591978 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.066632986 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.067394972 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.067814112 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.067838907 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.067879915 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.067899942 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.068169117 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.069933891 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.070022106 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.071460962 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.071558952 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.072163105 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.074760914 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.074809074 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.225764036 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.225924969 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.226001024 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.226766109 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.227255106 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.227318048 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.229053020 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.229077101 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.229140043 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.229284048 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.229413033 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.229439020 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.230019093 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.231257915 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.231518030 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.234065056 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.234194994 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.234822989 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.236078978 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.236273050 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.386503935 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.387283087 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.387368917 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.387414932 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.387703896 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.387765884 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.388945103 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.389393091 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.389472008 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.390989065 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.393315077 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.393793106 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.394697905 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.395555973 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.397571087 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.399791956 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.400222063 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.401173115 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.401897907 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.546780109 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.549226999 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.549345970 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.550904989 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.551356077 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.552669048 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.552685022 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.552730083 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.554615974 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.554624081 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.554964066 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.555016041 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.555809975 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.556683064 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.556698084 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.556762934 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.559412956 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.561655045 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.707510948 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.707539082 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.707597971 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.708391905 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.710498095 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.710611105 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.710875988 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.710954905 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.712089062 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.712156057 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.712409973 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.712460995 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.713972092 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.714049101 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.714867115 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.715418100 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.715467930 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.718871117 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.719666958 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.871530056 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.871697903 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.871762991 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.872957945 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.873842001 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.873914957 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.874258041 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.874667883 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.875134945 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.875200033 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.875777006 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.876840115 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.877320051 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.877482891 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:50.879538059 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.880676985 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.881726027 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.882107019 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:50.882292986 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.024753094 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 21, 2024 00:19:51.030771971 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.032610893 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.032710075 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.033071995 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.033279896 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.033293962 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.033339024 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.033637047 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.033685923 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.033953905 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.035806894 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.036206007 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.036757946 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.036986113 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.038780928 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.040695906 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.040934086 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.041558981 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.041826963 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.190184116 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.191648006 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.191737890 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.192979097 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.193563938 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.193928003 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.195362091 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.195426941 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.195554018 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.195569992 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.196975946 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.197027922 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.197664976 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.197820902 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.198714018 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.198791027 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.200547934 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.202554941 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.203732014 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.350126982 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.350145102 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.350234032 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.350486994 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.352983952 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.353349924 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.353349924 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.353460073 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.354252100 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.355065107 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.355118036 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.356483936 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.357559919 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.357691050 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.358156919 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.358244896 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.361257076 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.362395048 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.362433910 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.415359974 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 21, 2024 00:19:51.626132011 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626149893 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626174927 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626192093 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626208067 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626219034 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.626224041 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626238108 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626269102 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.626307011 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.626547098 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.626591921 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.632594109 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.634377956 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.638300896 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.640392065 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.647702932 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.650494099 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.651907921 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.652543068 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.655267954 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.656663895 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.793253899 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.793472052 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.793519020 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.796746969 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.797406912 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.799905062 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.802433968 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.804696083 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.817444086 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.817471981 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.817517042 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.818536043 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.818933010 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.818973064 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.820121050 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.821438074 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.821576118 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.826494932 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.953370094 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.956120014 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.956204891 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.957278013 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.958880901 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.963983059 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.976268053 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.977673054 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.977736950 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.977777958 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.979788065 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.980564117 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.980978966 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:51.981045008 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.983553886 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:51.985425949 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.034378052 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.115967035 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.115988970 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.116005898 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.116029978 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.119792938 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.119838953 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.122426033 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.127866030 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.321868896 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.321907043 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.321926117 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.321942091 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.321959019 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.322005987 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.322052956 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.322067976 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.322146893 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.322384119 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.325314999 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.325364113 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.325731039 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.330478907 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.330524921 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.474184990 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.477379084 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.477503061 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.477503061 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.479651928 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.481810093 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.481839895 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.481884003 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.482075930 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.482163906 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.482368946 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.482558012 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.482615948 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.484273911 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.484380007 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.489140987 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.534384966 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.632792950 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.635596991 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.635663986 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:52.639431953 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.639842987 CEST	443	49703	13.107.246.45	192.168.2.8
Oct 21, 2024 00:19:52.639893055 CEST	49703	443	192.168.2.8	13.107.246.45
Oct 21, 2024 00:19:53.055906057 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 21, 2024 00:19:53.430880070 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 21, 2024 00:19:59.719839096 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 21, 2024 00:20:00.709167004 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.709203005 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:00.709424973 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.709521055 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.709567070 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:00.709741116 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.711261988 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.711277962 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:00.711508036 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:00.711524010 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.781512976 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.781764030 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.781779051 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.782500029 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.782742023 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.782766104 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.782877922 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.782953024 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.782959938 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.782998085 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.783881903 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.783972025 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.783979893 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.784030914 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.784149885 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.784224987 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.784674883 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.784682035 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.785137892 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.785204887 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.830835104 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.830847979 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:01.830868959 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:01.879232883 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:02.050071955 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 21, 2024 00:20:02.658274889 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 21, 2024 00:20:02.719187975 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:02.719264030 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:02.719276905 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:02.719285965 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:02.719332933 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:02.721031904 CEST	49710	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:02.721046925 CEST	443	49710	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:02.727596998 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:02.775449991 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:03.038600922 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 21, 2024 00:20:03.067714930 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:03.067780972 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:03.067872047 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:03.068098068 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:03.068115950 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:03.559510946 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:03.559564114 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:03.559855938 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:03.561240911 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:03.561263084 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:03.830091953 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:03.830154896 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:03.830199003 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:03.830684900 CEST	49711	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:03.830704927 CEST	443	49711	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:03.831852913 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:03.831897974 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:03.831967115 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:03.832223892 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:03.832237959 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.135550022 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:04.135855913 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:04.135889053 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:04.137322903 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:04.137547970 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:04.138708115 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:04.138803005 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:04.189898968 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:04.189930916 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:04.238051891 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:04.612050056 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.612139940 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:04.615619898 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:04.615628004 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.616117954 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.657434940 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:04.695111990 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:04.739406109 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.874871016 CEST	443	49704	23.206.229.226	192.168.2.8
Oct 21, 2024 00:20:04.874979019 CEST	49704	443	192.168.2.8	23.206.229.226
Oct 21, 2024 00:20:04.901642084 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.902085066 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:04.902112961 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.902731895 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.903331995 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:04.903331995 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:04.903347015 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.903423071 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:04.957138062 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:04.996525049 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.996592999 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.996754885 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:04.996788979 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 21, 2024 00:20:04.996828079 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 21, 2024 00:20:06.013202906 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:06.013267040 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:06.013365030 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:06.013679028 CEST	49718	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:06.013698101 CEST	443	49718	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:07.071027994 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.071084023 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:07.071254015 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.071516037 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.071530104 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:07.114278078 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.114317894 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:07.114468098 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.114809990 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:07.114830017 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.115537882 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.159121037 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.164956093 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.217417955 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.285959005 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.285975933 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.286516905 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.286531925 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.286560059 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.287106991 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.317770958 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.317953110 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.318455935 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.318653107 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:08.319013119 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.362951040 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:08.363398075 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:09.395648956 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:09.395714998 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:09.395839930 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:09.396260023 CEST	49720	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:09.396277905 CEST	443	49720	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:11.595552921 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:11.595585108 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:11.595778942 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:11.601023912 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:11.601035118 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:12.909703016 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:12.909785986 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:12.916574001 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:12.916587114 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:12.916888952 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:12.971136093 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:13.818984985 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:13.863399982 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:14.193650007 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:14.193706036 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:14.193773031 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:14.253413916 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:14.253534079 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:14.253725052 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.253725052 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.398477077 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.398516893 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:14.398607016 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.400949955 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.400963068 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:14.478254080 CEST	49716	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:20:14.478269100 CEST	443	49716	142.250.186.100	192.168.2.8
Oct 21, 2024 00:20:14.481304884 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:14.481369019 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:14.485330105 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:14.488940001 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:14.488972902 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:14.491327047 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:14.535394907 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:14.563874006 CEST	49723	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:14.563891888 CEST	443	49723	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:15.427006006 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.427073956 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.427146912 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:15.427285910 CEST	49721	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:15.427300930 CEST	443	49721	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.521898031 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.522377968 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:15.522394896 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.522762060 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.523188114 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:15.523255110 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.523422956 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:15.571412086 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:15.706051111 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:15.706145048 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:15.707986116 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:15.707997084 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:15.708297968 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:15.710928917 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:15.755409956 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.146121025 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.146181107 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.146296024 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:16.146323919 CEST	443	49726	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.146336079 CEST	49726	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:16.193916082 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:16.193964005 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.194031000 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:16.194468975 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:16.194480896 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:16.608225107 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:16.608280897 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:16.608395100 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:16.608756065 CEST	49727	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:16.608777046 CEST	443	49727	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:17.524399042 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.524476051 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:17.525923014 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:17.525940895 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.526171923 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.527437925 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:17.575407982 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.972873926 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.972929001 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:17.973026037 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:17.973108053 CEST	49729	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:17.973135948 CEST	443	49729	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:18.005753994 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:18.005798101 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:18.005876064 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:18.006421089 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:18.006441116 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:18.838087082 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.838129997 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:18.838392019 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.838395119 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.838443041 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:18.838924885 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.838944912 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:18.838973045 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.839287996 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:18.839302063 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.313554049 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.313721895 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:19.315509081 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:19.315521955 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.315788984 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.316972971 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:19.363444090 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.749586105 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.749654055 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.749761105 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:19.752960920 CEST	49731	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:19.752974033 CEST	443	49731	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:19.888849974 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.890451908 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.917519093 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.917536974 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.917973995 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.920587063 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.920644999 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.921086073 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.933651924 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.933744907 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.939796925 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.939919949 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:19.942972898 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.981753111 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:19.983403921 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:20.061813116 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:20.061856031 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:20.062223911 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:20.062609911 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:20.062623024 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.041289091 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:21.041358948 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:21.042098045 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:21.042118073 CEST	443	49732	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:21.042146921 CEST	49732	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:21.381876945 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.381985903 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.387336969 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.387343884 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.387583971 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.391419888 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.439404011 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.825985909 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.826055050 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.826193094 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.826215029 CEST	443	49734	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.826251030 CEST	49734	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.855609894 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.855657101 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:21.855731010 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.856056929 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:21.856070995 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.174799919 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.174907923 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.179513931 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.179528952 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.179775000 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.181251049 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.227407932 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.616157055 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.616344929 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.616439104 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.619348049 CEST	49735	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.619369030 CEST	443	49735	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.646799088 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.646837950 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:23.647129059 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.647581100 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:23.647598982 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:24.950701952 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:24.950813055 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:24.970254898 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:24.970277071 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:24.970606089 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:24.973037958 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.019395113 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:25.402642965 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:25.402721882 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:25.402832985 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.402906895 CEST	49736	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.402925014 CEST	443	49736	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:25.420856953 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.420897961 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:25.421020985 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.421449900 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:25.421462059 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:26.729295969 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:26.729374886 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:26.730890036 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:26.730905056 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:26.731230021 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:26.732295990 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:26.779412031 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:27.166557074 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:27.166637897 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:27.166699886 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:27.166961908 CEST	49737	443	192.168.2.8	4.245.163.56
Oct 21, 2024 00:20:27.166984081 CEST	443	49737	4.245.163.56	192.168.2.8
Oct 21, 2024 00:20:28.229737043 CEST	59265	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:28.236104965 CEST	53	59265	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:28.236171961 CEST	59265	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:28.236207008 CEST	59265	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:28.242255926 CEST	53	59265	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:28.996501923 CEST	53	59265	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:28.997328043 CEST	59265	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:29.002610922 CEST	53	59265	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:29.002703905 CEST	59265	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:31.440289974 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:31.440351963 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:31.440412998 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:31.441266060 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:31.441284895 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:31.451323032 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:31.491410017 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.510665894 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.510956049 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:32.510986090 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.511351109 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.511699915 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:32.511780024 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.543968916 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.544114113 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.544230938 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:32.544307947 CEST	443	49733	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:32.544373989 CEST	49733	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:32.544692039 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:32.587444067 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:33.665203094 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:33.665364027 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:33.665659904 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:33.665693045 CEST	443	59266	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:33.665707111 CEST	59266	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:33.667115927 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:33.667165041 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:33.667310953 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:33.667603016 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:33.667618036 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:34.735371113 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:34.735802889 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:34.735826015 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:34.736171961 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:34.736521959 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:34.736588955 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:34.736881971 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:34.779408932 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:35.833585024 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:35.833786964 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:35.833869934 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:35.849450111 CEST	59268	443	192.168.2.8	18.244.18.6
Oct 21, 2024 00:20:35.849477053 CEST	443	59268	18.244.18.6	192.168.2.8
Oct 21, 2024 00:20:42.056262016 CEST	53171	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:42.061244965 CEST	53	53171	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:42.061439037 CEST	53171	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:42.061474085 CEST	53171	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:42.066382885 CEST	53	53171	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:42.811543941 CEST	53	53171	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:42.811930895 CEST	53171	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:42.818650961 CEST	53	53171	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:42.818715096 CEST	53171	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:21:03.077832937 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:03.077887058 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:03.077951908 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:03.078212976 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:03.078232050 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:04.149137974 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:04.149470091 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:04.149504900 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:04.149820089 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:04.150252104 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:04.150312901 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:04.200920105 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:05.154975891 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:05.155026913 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:05.155097961 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:05.155546904 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:05.155564070 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:05.927458048 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.927532911 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:05.927624941 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.934092999 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.934117079 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:05.934202909 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.934741974 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.934752941 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:05.934972048 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:05.934978962 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.183561087 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.183645010 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.185128927 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.185142040 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.185375929 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.186901093 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.227418900 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.526731014 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.526799917 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.526873112 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.527046919 CEST	53176	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.527077913 CEST	443	53176	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.529428959 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.529474020 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.529604912 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.530117035 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:06.530129910 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:06.992811918 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.993151903 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:06.993168116 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.993511915 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.994136095 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:06.994204044 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.994421005 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:06.995897055 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.996226072 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:06.996236086 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.996620893 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:06.997026920 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:06.997092962 CEST	443	53178	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:07.039403915 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:07.049386024 CEST	53178	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:07.562894106 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.563014984 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.590924025 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.590956926 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.591214895 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.610007048 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.651418924 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.948148012 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.948209047 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.948261023 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.948381901 CEST	53179	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.948395967 CEST	443	53179	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.983782053 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.983836889 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:07.983921051 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.984565973 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:07.984579086 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:08.084925890 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:08.085012913 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:08.085027933 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:08.085078001 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:08.095019102 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:08.095087051 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:08.095133066 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:08.100766897 CEST	53177	443	192.168.2.8	18.244.18.42
Oct 21, 2024 00:21:08.100780964 CEST	443	53177	18.244.18.42	192.168.2.8
Oct 21, 2024 00:21:09.019188881 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.019309998 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.021346092 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.021361113 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.021630049 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.029126883 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.075395107 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.372169018 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.372236013 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.373564959 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.382729053 CEST	53180	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.382756948 CEST	443	53180	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.465929985 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.465975046 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:09.469747066 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.469747066 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:09.469779968 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.495733976 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.495819092 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.498439074 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.498450994 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.498692036 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.500663996 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.543397903 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.839718103 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.839782953 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.839827061 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.839899063 CEST	53181	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.839919090 CEST	443	53181	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.869456053 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.869491100 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:10.869563103 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.870507002 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:10.870516062 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:11.901761055 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:11.901899099 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:11.903229952 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:11.903243065 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:11.903501034 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:11.904887915 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:11.951416969 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:12.249804974 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:12.249872923 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:12.251502991 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:12.677789927 CEST	53182	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:12.677819014 CEST	443	53182	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:12.696647882 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:12.696746111 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:12.696832895 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:12.698347092 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:12.698395967 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:13.738820076 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:13.738893032 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:13.740433931 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:13.740449905 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:13.740664959 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:13.741760969 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:13.787394047 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.088519096 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.088578939 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.088639021 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:14.088716030 CEST	53183	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:14.088732958 CEST	443	53183	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.109622955 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:14.109653950 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.109714985 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:14.110179901 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:14.110188961 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:14.166771889 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:14.166857958 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:14.166992903 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:15.146523952 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.146631956 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.147594929 CEST	53174	443	192.168.2.8	142.250.186.100
Oct 21, 2024 00:21:15.147644997 CEST	443	53174	142.250.186.100	192.168.2.8
Oct 21, 2024 00:21:15.149744034 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.149760962 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.150027990 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.152350903 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.195401907 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.495847940 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.495867014 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.495894909 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.495929003 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.495939970 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.495965958 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.495984077 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.498955965 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.498991966 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.499016047 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.499028921 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.499039888 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:15.499058008 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:15.499078035 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:16.577972889 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:16.577996016 CEST	443	53185	20.109.210.53	192.168.2.8
Oct 21, 2024 00:21:16.578010082 CEST	53185	443	192.168.2.8	20.109.210.53
Oct 21, 2024 00:21:16.578017950 CEST	443	53185	20.109.210.53	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 00:19:58.934283018 CEST	53	49757	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:00.467717886 CEST	57113	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:00.467909098 CEST	53521	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:00.488446951 CEST	53	53521	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:00.502795935 CEST	53	57113	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:03.059070110 CEST	49244	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:03.059267044 CEST	60045	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:20:03.066441059 CEST	53	60045	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:03.066746950 CEST	53	49244	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:28.229234934 CEST	53	56626	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:40.179156065 CEST	138	138	192.168.2.8	192.168.2.255
Oct 21, 2024 00:20:42.055279016 CEST	53	63065	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:58.383411884 CEST	53	53691	1.1.1.1	192.168.2.8
Oct 21, 2024 00:20:59.995023012 CEST	53	53877	1.1.1.1	192.168.2.8
Oct 21, 2024 00:21:05.884233952 CEST	50790	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:21:05.884391069 CEST	59122	53	192.168.2.8	1.1.1.1
Oct 21, 2024 00:21:05.905663967 CEST	53	50790	1.1.1.1	192.168.2.8
Oct 21, 2024 00:21:05.908015966 CEST	53	59122	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 00:20:00.467717886 CEST	192.168.2.8	1.1.1.1	0xa34d	Standard query (0)	es.research.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:00.467909098 CEST	192.168.2.8	1.1.1.1	0xf43e	Standard query (0)	es.research.net	65	IN (0x0001)	false
Oct 21, 2024 00:20:03.059070110 CEST	192.168.2.8	1.1.1.1	0xbdf3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:03.059267044 CEST	192.168.2.8	1.1.1.1	0x4966	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 21, 2024 00:21:05.884233952 CEST	192.168.2.8	1.1.1.1	0xd29e	Standard query (0)	es.research.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.884391069 CEST	192.168.2.8	1.1.1.1	0x1f27	Standard query (0)	es.research.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 00:20:00.488446951 CEST	1.1.1.1	192.168.2.8	0xf43e	No error (0)	es.research.net	g-sm-prod-cloudeng-frontdoor.svmkinfra.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:20:00.488446951 CEST	1.1.1.1	192.168.2.8	0xf43e	No error (0)	g-sm-prod-cloudeng-frontdoor.svmkinfra.com	d2yx97y2ukjhui.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	es.research.net	g-sm-prod-cloudeng-frontdoor.svmkinfra.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	g-sm-prod-cloudeng-frontdoor.svmkinfra.com	d2yx97y2ukjhui.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.6	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.118	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.107	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:00.502795935 CEST	1.1.1.1	192.168.2.8	0xa34d	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.42	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:03.066441059 CEST	1.1.1.1	192.168.2.8	0x4966	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 21, 2024 00:20:03.066746950 CEST	1.1.1.1	192.168.2.8	0xbdf3	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:13.041459084 CEST	1.1.1.1	192.168.2.8	0xe8b1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:13.041459084 CEST	1.1.1.1	192.168.2.8	0xe8b1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:20:14.568226099 CEST	1.1.1.1	192.168.2.8	0xf26d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:20:14.568226099 CEST	1.1.1.1	192.168.2.8	0xf26d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	es.research.net	g-sm-prod-cloudeng-frontdoor.svmkinfra.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	g-sm-prod-cloudeng-frontdoor.svmkinfra.com	d2yx97y2ukjhui.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.42	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.118	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.6	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.905663967 CEST	1.1.1.1	192.168.2.8	0xd29e	No error (0)	d2yx97y2ukjhui.cloudfront.net		18.244.18.107	A (IP address)	IN (0x0001)	false
Oct 21, 2024 00:21:05.908015966 CEST	1.1.1.1	192.168.2.8	0x1f27	No error (0)	es.research.net	g-sm-prod-cloudeng-frontdoor.svmkinfra.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 00:21:05.908015966 CEST	1.1.1.1	192.168.2.8	0x1f27	No error (0)	g-sm-prod-cloudeng-frontdoor.svmkinfra.com	d2yx97y2ukjhui.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

es.research.net

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:01 UTC	965	OUT	GET /tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D HTTP/1.1 Host: es.research.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-20 22:20:02 UTC	2288	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Content-Length: 314 Connection: close Date: Sun, 20 Oct 2024 22:20:02 GMT Access-Control-Expose-Headers: Server-Timing Server-Timing: traceparent;desc="00-22b83336a14bddbeaf0990594ec27681-f900d031cf8806f0-01" server: nginx location: https://es.research.net/user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr sm-request-id: gUMlCur7WlSWQueFaS8AMWpiRrryAfAgMzVBNI_ZGjAzmaEit-a6hg== content-security-policy: default-src https: data: blob: 'unsafe-eval' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.recaptcha.net https://api.amplitude.com https://api2.amplitude.com https://.crazyegg.com wss://.hotjar.com wss://.qualified.com 'self'; upgrade-insecure-requests; frame-ancestors 'self' https://.zendesk.com https://.myshopify.com https://teams.microsoft.com https://.eloqua.com https://.surveymonkey.com https://.sharepoint.com https://.worldpay.com https://.cardinalcommerce.com https://.office.com https://.office365.com https://.microsoft365.com https://.cloud.microsoft; x-xss-protection: 1;mode=block x-content-type-options: nosniff Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains cache-control: no-cache="Set-Cookie" set-cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; Domain=.research.net; expires=Mon, 20 Oct 2025 22:20:02 GMT; Path=/; SameSite=none; Secure set-cookie: cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:20:02 GMT; Path=/; SameSite=none; Secure set-cookie: ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; Domain=.research.net; expires=Sun, 20 Oct 2024 22:50:02 GMT; Path=/; SameSite=none; Secure set-cookie: ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:20:02 GMT; Path=/; SameSite=none; Secure set-cookie: ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:20:02 GMT; HttpOnly; Path=/; SameSite=none; Secure X-Cache: Miss from cloudfront Via: 1.1 b166ca183629eada7c88ffe6bf8562a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: gUMlCur7WlSWQueFaS8AMWpiRrryAfAgMzVBNI_ZGjAzmaEit-a6hg==
2024-10-20 22:20:02 UTC	314	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 20 20 54 68 65 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 6d 6f 76 65 64 20 74 6f 20 68 74 74 70 73 3a 2f 2f 65 73 2e 72 65 73 65 61 72 63 68 2e 6e 65 74 2f 75 73 65 72 2f 65 6d 61 69 6c 2d 6f 70 74 2d 6f 75 74 2f 3f 73 6d 3d 77 6c 32 46 4b 55 37 32 45 47 59 75 36 32 56 79 50 41 77 58 71 5f 32 42 78 4e 4c 59 6c 76 39 62 4a 5a 71 73 5f 32 46 4f 7a 6a 56 41 44 54 4f 76 73 6e 4e 49 43 4c 79 61 5f 32 42 53 63 75 6a 32 66 5a 54 6c 47 72 3b Data Ascii: <html> <head> <title>301 Moved Permanently</title> </head> <body> <h1>301 Moved Permanently</h1> The resource has been moved to https://es.research.net/user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:02 UTC	961	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:04 UTC	961	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:08 UTC	987	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49723	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49721	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:14 UTC	987	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49727	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:15 UTC	987	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49726	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49729	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49731	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49732	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:19 UTC	993	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49734	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49735	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49736	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49737	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49733	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:31 UTC	993	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	59266	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:32 UTC	993	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	59268	18.244.18.6	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:20:34 UTC	993	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	53176	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	53177	18.244.18.42	443	3964	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:06 UTC	993	OUT	GET /user/email-opt-out/?sm=wl2FKU72EGYu62VyPAwXq_2BxNLYlv9bJZqs_2FOzjVADTOvsnNICLya_2BScuj2fZTlGr HTTP/1.1 Host: es.research.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="
2024-10-20 22:21:08 UTC	4085	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Sun, 20 Oct 2024 22:21:07 GMT Vary: Accept-Encoding vary: Accept-Encoding, Accept-Encoding Access-Control-Expose-Headers: Server-Timing Server-Timing: traceparent;desc="00-685af39b02c4fc9c200c3e95a99cef16-ab48284551ef46a6-01" server: nginx x-nginx-pool-override-enabled: 1 sm-request-id: KSqM7S8CCvEI4tAg7_M0ib4AaGWvXvqkzUgHldM5q2mMz5CXkMNjlA== cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin origin-agent-cluster: ?1 Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-permitted-cross-domain-policies: none x-xss-protection: 0 content-security-policy: default-src https: data: blob: 'self' https://api.amplitude.com https://api2.amplitude.com; upgrade-insecure-requests; style-src 'unsafe-eval' 'unsafe-inline' 'self' https://.trustedshops.com https://.gstatic.com/ https://.smassets.net https://.surveymonkey.com; frame-ancestors 'self' https://.zendesk.com https://.myshopify.com https://.cloud.microsoft https://teams.microsoft.com https://.eloqua.com https://.office.com https://.office365.com https://.surveymonkey.com; script-src 'unsafe-eval' 'unsafe-inline' https: 'self' 'strict-dynamic' https://api.amplitude.com https://api2.amplitude.com 'nonce-y0I6yB1r5aK4uFvI9g2qTw=='; object-src 'none'; base-uri 'self' x-content-security-policy: default-src https: data: blob: 'self' https://api.amplitude.com https://api2.amplitude.com; upgrade-insecure-requests; style-src 'unsafe-eval' 'unsafe-inline' 'self' https://.trustedshops.com https://.gstatic.com/ https://.smassets.net https://.surveymonkey.com; frame-ancestors 'self' https://.zendesk.com https://.myshopify.com https://.cloud.microsoft https://teams.microsoft.com https://.eloqua.com https://.office.com https://.office365.com https://.surveymonkey.com; script-src 'unsafe-eval' 'unsafe-inline' https: 'self' 'strict-dynamic' https://api.amplitude.com https://api2.amplitude.com 'nonce-y0I6yB1r5aK4uFvI9g2qTw=='; object-src 'none'; base-uri 'self' x-webkit-csp: default-src https: data: blob: 'self' https://api.amplitude.com https://api2.amplitude.com; upgrade-insecure-requests; style-src 'unsafe-eval' 'unsafe-inline' 'self' https://.trustedshops.com https://.gstatic.com/ https://.smassets.net https://.surveymonkey.com; frame-ancestors 'self' https://.zendesk.com https://.myshopify.com https://.cloud.microsoft https://teams.microsoft.com https://.eloqua.com https://.office.com https://.office365.com https://*.surveymonkey.com; script-src 'unsafe-eval' 'unsafe-inline' https: 'self' 'strict-dynamic' https://api.amplitude.com https://api2.amplitude.com 'nonce-y0I6yB1r5aK4uFvI9g2qTw=='; object-src 'none'; base-uri 'self' cache-control: no-cache="Set-Cookie" set-cookie: attr_multitouch="EHyrltK0ya0X5Jh6Bf6Z8Z61VLk="; Domain=.research.net; expires=Mon, 20 Oct 2025 22:21:07 GMT; Path=/; SameSite=none; Secure set-cookie: cdp_seg="Byk67pczRugSTwG1zEaSCeRVuf8="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:21:07 GMT; Path=/; SameSite=none; Secure set-cookie: ep201="bXb13btLQ07yW1bWXoG1mb3QwsE="; Domain=.research.net; expires=Sun, 20 Oct 2024 22:51:07 GMT; Path=/; SameSite=none; Secure set-cookie: ep202="30HXIMN0SKiktlDrYzcXmR8zgqM="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:21:07 GMT; Path=/; SameSite=none; Secure set-cookie: ep203="ktTPI0pnud3txGRcSFxRTEjO3RQ="; Domain=.research.net; expires=Sat, 18 Jan 2025 22:21:07 GMT; HttpOnly; Path=/; SameSite=none; Secure Via: 1.1 6ee3eecd683392286f206a7ea6e9ac0c.cloudfront.net (CloudFront), 1.1 717c15467a10d8501ae3f6716e2421d8.cloudfront.net (CloudFront) content-language: es X-Server: Smartling X-SL-Notranslate: 1 X-SL-Norewrite: 1 X-Amz-Cf-Pop: SFO53-P2 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-P11 X-Amz-Cf-Id: JRCVAjBPXPAEab1iVrVeeAvGyA23hEk0Dk7CWogEGRjVJT6uGwkjvA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	53179	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:07 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	53180	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:09 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	53181	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:10 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	53182	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	53183	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:13 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	53185	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-20 22:21:15 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ztdAyMdAhzWptoR&MD=8tVYvOMl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-20 22:21:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 90520800-1bdb-40a2-88d4-a30f9a45757a MS-RequestId: c8f4db0b-2b37-42e2-996e-b31ab1cc1e23 MS-CV: KK3TRteMdUWLp5F/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 20 Oct 2024 22:21:14 GMT Connection: close Content-Length: 30005
2024-10-20 22:21:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-20 22:21:15 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5880, Parent PID: 3652

General

Target ID:	0
Start time:	18:19:53
Start date:	20/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3964, Parent PID: 5880

General

Target ID:	2
Start time:	18:19:57
Start date:	20/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,1523407136651421618,18002775958250013191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5588, Parent PID: 3652

General

Target ID:	3
Start time:	18:19:59
Start date:	20/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://es.research.net/tr/v1/te/7C0u9Xl6xmMaK_2FgPq5vwYc3n3zMl9juoBtwLS5_2FR2i45ZpC_2FuXR0IpLc745ZV1IIu4gVtdrZXbAE4RNTtTQD700Ks4Csj8GFdHTUxRZDTXEa4frb3apTi0KdfH41Sy96vXCjvFieboz6PJEaBbkOAyfQWb4LVOa2VQvL77EWgbYCzmELu6SMly_2FsDbP4DYNyEwG4_2FnBaUX6NyldEycr4qlH1HyZcG1nQ6Ff1p_2FX5KEqOH5qL7htela7cGldqVA82AXanWZTnRYo_2Bem2JW39wrA_3D_3D"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5880, Parent PID: 3652

General

Chronological Activities

Analysis Process: chrome.exePID: 3964, Parent PID: 5880

General

Chronological Activities

Analysis Process: chrome.exePID: 5588, Parent PID: 3652

General

Chronological Activities

Disassembly