Edit tour

Windows Analysis Report
https://funcallback.com

Overview

General Information

Sample URL:	https://funcallback.com
Analysis ID:	1430953
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funcallback.com/ MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,7132797458047538153,14976899147334223984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Snort Signatures

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:27.365374
SID:	2051077
Source Port:	51626
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:28:16.564856
SID:	2051078
Source Port:	49785
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:26:27.700689
SID:	2051078
Source Port:	49702
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:46.715517
SID:	2050098
Source Port:	64519
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:26:27.699696
SID:	2051078
Source Port:	49701
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:27:52.089459
SID:	2051078
Source Port:	49780
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:46.715658
SID:	2050098
Source Port:	61885
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:27:52.090297
SID:	2051078
Source Port:	49781
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:41.735770
SID:	2050098
Source Port:	54798
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:41.736118
SID:	2050098
Source Port:	51778
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:28:13.498229
SID:	2051078
Source Port:	49783
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:28:20.107171
SID:	2051078
Source Port:	49788
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 1.1.1.1

Timestamp:	04/24/24-12:26:27.365633
SID:	2051077
Source Port:	55659
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) - Source IP: 192.168.2.17 - Destination IP: 31.41.44.109

Timestamp:	04/24/24-12:28:23.636061
SID:	2051078
Source Port:	49790
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://funcallback.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Ff&oit=3&cp=9&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fde&oit=3&cp=10&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeb&oit=3&cp=11&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeba&oit=3&cp=12&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebases&oit=3&cp=15&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesi&oit=3&cp=16&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesin&oit=3&cp=17&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZFdKoHn55bWTOl4&MD=xxnmnz36 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle&oit=3&cp=20&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.&oit=3&cp=21&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.lif&oit=3&cp=24&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.life&oit=3&cp=25&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://debasesingle.life/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: debasesingle.lifeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGO28o7EGIjDtljd6pm1ZWjTPyWP32HQBGX3sXwOJ767OIF2wF2ku1c4DUPfehf0hMaorp38NKnIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /9hFXWz7M HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAfJ5zkfP4NMtLPZKNffsE%2Bd4xusfhhTKPBHjey4oI7ua7TdrbsZN2dsosPlDJqfdmpd8ZaX%2BRz5QrGHxmbOUdyXm0LXZpkbSLQs1Ot6cwGIpFwSc7G%2BJA1DrTa2d6OJTCdp7NSGGUS/zuGxRYPPdZB8YqA%2BQ/1BD54H7uaTuJlJjroqMtnGP%2BL6R/EURhNvaGIyhzC3i0RPkmIgURHAuoOQRsXBCZiOnH2KGSIpyrdn258D6J6eu9GjlNRBuNFAEFER8KrlRCVi8tLk8KvsIOzcbyyk7NK5YDTxcA9wMKIT6GfXaZRed%2BmMrBuWkIxo0XrFOurjtYvsuZEO4Pc/0mHQDZgAACJECrBrIRSZ5qAEhLLipcZ5obAtG3U5WIzBEpSO94xfz8IMug9wJ%2BylLX6%2BCGt1SehsxJJ8jE5WXwVricdUwEXJhQR414o6s2AkQsY8oQIsXmp3HREoPoIrMC7Fmme2HrpimR0HINS8%2BsvsSg75aPukjQIoe3ts0qvuYBvK56lUeSHDpHh0etTqftfkfyOv6kcbMyCsS/Cs855jwIx2S%2BiQbBjY33yp7AP7w71PhxfsX/zwdEXQd9lGVVH0KMZnueOlEd25fjzMnwjEOlQGHmcorSClCYdybpZLcJFKvTDzLo46Hi7ZynI5KzyOYCinVw1CXYwPlFTeuHdB81JEeoXjJnfXcc/UnXSI5B1bB4W892BWguFbCIVpad55L9LDEB814rr5uT%2BmitNpj4TQTQq4wZwCxCV6tYdgzi2E/BxFj5iJI4wPIrnoHrFoFlFkAm8k/h2%2Bz%2BsPaFHikD4uMm3EbvAPQY8wdGuigpaQIAHOWACgIGCbs7XxOfCiMUeHY8ahvBjHzuKh3GitDVovKbJKXJJZFq3JjvnjKt1gvt7vu2IoPNYkZN1T7g4YLnK5BVs5q2QE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1713954414User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: ADC09E9D713846698E8E4785EB55C0F1X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9hFAWz7M HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGPq8o7EGIjCPZ7mLrGZOjiilg62h20hakliyrRjoptyj-G79OVFIZsyqFvdYeoEJ4nuR2vvBQHMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9FGNGFNFGJ HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9FGNGFNF HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9FGN HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZFdKoHn55bWTOl4&MD=xxnmnz36 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /a HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aDF HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIm9o7EGIjCr71g2DaGKX03zfbOMRvZGitgHQ5gSzz1_UmYnoZc9EYAOncPgEW9ebhFc9F3QvQIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /* HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /INDEX.PHP HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /INDEX HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /all HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /INDEX HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /INDEX.PHP HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /* HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9FGNGFNF HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9FGNGFNFGJ HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9hFXWz7M HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: debasesingle.lifeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dsfdsfsgf HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /home HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGMW9o7EGIjDoaiqIgJym7mPXMuk64a2_ECOop8aSMKF9PeWRy-JzRSbFSHqdq-5U6e7Bbe2Sn4MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /all HTTP/1.1Host: funcallback.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: debasesingle.lifeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: funcallback.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:26:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:26:28 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:26:29 GMTContent-Type: text/htmlContent-Length: 548Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:26:43 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:26:43 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:26:43 GMTContent-Type: text/htmlContent-Length: 548Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:26:48 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:26:48 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:02 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:02 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:05 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:05 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:09 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:09 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:12 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:12 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:13 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:18 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:20 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:24 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:24 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:30 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:30 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:34 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:38 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:50 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:27:53 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:27:53 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:28:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:28:13 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:28:16 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:28:16 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:28:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:28:20 GMTVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Apr 2024 10:28:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 147Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 24 Apr 2024 10:28:23 GMTVary: Accept-Encoding

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.230.129:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.230.129:443 -> 192.168.2.17:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.129:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.129:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49754 version: TLS 1.2

Source: classification engine

Classification label: mal80.win@17/10@8/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funcallback.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,7132797458047538153,14976899147334223984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,7132797458047538153,14976899147334223984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://funcallback.com	100%	Avira URL Cloud	malware
https://funcallback.com	20%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
debasesingle.life	17%	Virustotal		Browse
funcallback.com	20%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://debasesingle.life/	100%	Avira URL Cloud	malware
https://funcallback.com/favicon.ico	100%	Avira URL Cloud	malware
https://debasesingle.life/favicon.ico	100%	Avira URL Cloud	malware
http://debasesingle.life/	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
funcallback.com	31.41.44.109	true	true	20%, Virustotal, Browse	unknown
debasesingle.life	31.41.44.109	true	true	17%, Virustotal, Browse	unknown
www.google.com	142.250.141.106	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeba&oit=3&cp=12&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://debasesingle.life/9hFXWz7M	false		unknown
https://debasesingle.life/a	false		unknown
https://debasesingle.life/*	false		unknown
https://funcallback.com/all	false		unknown
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGMW9o7EGIjDoaiqIgJym7mPXMuk64a2_ECOop8aSMKF9PeWRy-JzRSbFSHqdq-5U6e7Bbe2Sn4MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://debasesingle.life/9FGNGFNF	false		unknown
https://debasesingle.life/9FGN	false		unknown
https://funcallback.com/favicon.ico	true	Avira URL Cloud: malware	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fde&oit=3&cp=10&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesi&oit=3&cp=16&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://debasesingle.life/9FGNGFNFGJ	false		unknown
https://debasesingle.life/INDEX.PHP	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.&oit=3&cp=21&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://debasesingle.life/	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGPq8o7EGIjCPZ7mLrGZOjiilg62h20hakliyrRjoptyj-G79OVFIZsyqFvdYeoEJ4nuR2vvBQHMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.lif&oit=3&cp=24&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://funcallback.com/dsfdsfsgf	false		unknown
https://funcallback.com/index	false		unknown
https://debasesingle.life/aDF	false		unknown
https://funcallback.com/	false		unknown
https://debasesingle.life/all	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Ff&oit=3&cp=9&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.life&oit=3&cp=25&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://debasesingle.life/favicon.ico	true	Avira URL Cloud: malware	unknown
https://funcallback.com/home	false		unknown
https://debasesingle.life/	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeb&oit=3&cp=11&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle&oit=3&cp=20&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIm9o7EGIjCr71g2DaGKX03zfbOMRvZGitgHQ5gSzz1_UmYnoZc9EYAOncPgEW9ebhFc9F3QvQIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://debasesingle.life/9hFAWz7M	false		unknown
https://debasesingle.life/INDEX	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesin&oit=3&cp=17&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebases&oit=3&cp=15&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGO28o7EGIjDtljd6pm1ZWjTPyWP32HQBGX3sXwOJ767OIF2wF2ku1c4DUPfehf0hMaorp38NKnIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.41.44.109	funcallback.com	Russian Federation	56577	ASRELINKRU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.141.106	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.6
192.168.2.5
192.168.2.13
192.168.2.23

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430953
Start date and time:	2024-04-24 12:25:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://funcallback.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.win@17/10@8/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.137.94, 142.251.2.138, 142.251.2.101, 142.251.2.139, 142.251.2.102, 142.251.2.100, 142.251.2.113, 142.251.2.84, 34.104.35.123, 199.232.214.172, 192.229.211.108, 23.1.234.24, 142.251.2.94, 23.1.234.32
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:26:28 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9881634588090558
Encrypted:	false
SSDEEP:	48:8X34WdDTA7FCsHIidAKZdA1JehwiZUklqeh9y+3:8Hzc8ey
MD5:	4190A6B3A2563B19CF3E432E30FE2BB8
SHA1:	6FA6034625EE0D6F41B89EA1FA9AF3FAB1C89950
SHA-256:	7CB070BCDDB76AE122F289F481CF196FC02D99F4B08281FE07054890080E118F
SHA-512:	E853D0F0CEB88F3A4070CDAF2D6B78AF3F72B9171A4FA45075E5C9216A0B7C14248AF1BEDB2A9AC098BA16FDEC4F6C32E3990B4B0264A7092F27172C9BF7D767
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......,.1.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XOS...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:26:28 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004348998365871
Encrypted:	false
SSDEEP:	48:8U4WdDTA7FCsHIidAKZdA10eh/iZUkAQkqehOy+2:8Uzc+9Qry
MD5:	58C5FE09B986762FD7D6D1D0067FBED0
SHA1:	23148D078F84E5984D0D0284CC48FF62E8CF02A0
SHA-256:	BA0BF511B79F80088FFC9A8E3F1BC244BD368EE8015C754971EE91DE8C4CD3A0
SHA-512:	601B0FE996838CDD2E28C339D112CCA5AB1048DBCD5BFB7EA8A2ECB0FFE73F602F05C93975578606653A91A7320416FC690B621236CB5CB23F6048229ADDFA1E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....\|~..1.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XOS...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.013962467055464
Encrypted:	false
SSDEEP:	48:8e4WdDTA7FjHIidAKZdA14tIeh7sFiZUkmgqeh7ssy+BX:8ezcsnKy
MD5:	C6AD4C05AE07152BD51E596872639767
SHA1:	0C098CCBE533DBE1E75ECD762C8616EA4701BDEE
SHA-256:	538E6D2F808230EA44EF0A1CF55FE9F00F462F884657DC16ABA9B5ED16E864E9
SHA-512:	BC22AD5A6FB3848FE8401740A945099E2A1B46690455D03539FC73F97825C5BC11C97901E281E0F39B979A45FC33E0173A5BD97D6F25D9ABDB6A18177F601FEF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:26:28 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.003270119519578
Encrypted:	false
SSDEEP:	48:844WdDTA7FCsHIidAKZdA1behDiZUkwqehiy+R:84zcVky
MD5:	FDEC9698278716822E3D128D6C158F71
SHA1:	A9218EB784EAA144F9303F210CE36617B465D8B0
SHA-256:	DF064086E62B201B7ED1607FB15916F2EE45EDED5D248CD839610184B16B1A7C
SHA-512:	79A0ABBC0593F1FEF46E5E71C030AC0587CF38BAE7CAE805A860E394A76CE64A90483F14BDC0050999462685129D95D4EA5F0C4013B82A6889BAFC43AFDA2747
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........1.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XOS...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:26:28 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9920267980277306
Encrypted:	false
SSDEEP:	48:8U4WdDTA7FCsHIidAKZdA1VehBiZUk1W1qehYy+C:8UzcF94y
MD5:	EEE386A25B8A592A2334AF41EB78EAC2
SHA1:	754E143BCAEF9CF010E42DD50FEBD9EBFB5C6F20
SHA-256:	0A3F376DF432C3821B9201981BFA76B38CE28064E64C251830A9304B335EC573
SHA-512:	1EB4505647E6B1E6C7DDB35E66D8150E7B25C9154AA0F7E5A015CCC0791ED35F4FE0C3B350E48C4A877940CD038E45DB392A5780308E9F1CE11BC7DE987D32BB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......&.1.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XOS...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:26:28 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0058476430131575
Encrypted:	false
SSDEEP:	48:8WQ4WdDTA7FCsHIidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbKy+yT+:8XzcFTTTbxWOvTbKy7T
MD5:	6EC54673A00D63FF80D932839BF03A7C
SHA1:	351ECD80E3B62505D59CE89BD0EE81EDB80CD1E2
SHA-256:	45DD6DDCB3F8E719D7A7A8EA4C7DB55C4EF16806B18BD61CEB27CEB35AB9D0C5
SHA-512:	6BBE8FE0E8CB9EC43ABBCF99A9DB5CF136F54635510707EE5F1DBFBB2AF3FC7E3002FB431ABC20BD1BE9901FB9ACC2B7F1A6FF825A25C577104174053583AFA2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........1.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.XFS....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XMS....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XMS....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XMS...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XOS...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........M..Z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://debasesingle.life/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://funcallback.com/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-12:26:27.365374	UDP	2051077	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com)	51626	53	192.168.2.17	1.1.1.1
04/24/24-12:28:16.564856	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49785	443	192.168.2.17	31.41.44.109
04/24/24-12:26:27.700689	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49702	443	192.168.2.17	31.41.44.109
04/24/24-12:26:46.715517	UDP	2050098	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life)	64519	53	192.168.2.17	1.1.1.1
04/24/24-12:26:27.699696	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49701	443	192.168.2.17	31.41.44.109
04/24/24-12:27:52.089459	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49780	443	192.168.2.17	31.41.44.109
04/24/24-12:26:46.715658	UDP	2050098	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life)	61885	53	192.168.2.17	1.1.1.1
04/24/24-12:27:52.090297	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49781	443	192.168.2.17	31.41.44.109
04/24/24-12:26:41.735770	UDP	2050098	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life)	54798	53	192.168.2.17	1.1.1.1
04/24/24-12:26:41.736118	UDP	2050098	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life)	51778	53	192.168.2.17	1.1.1.1
04/24/24-12:28:13.498229	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49783	443	192.168.2.17	31.41.44.109
04/24/24-12:28:20.107171	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49788	443	192.168.2.17	31.41.44.109
04/24/24-12:26:27.365633	UDP	2051077	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com)	55659	53	192.168.2.17	1.1.1.1
04/24/24-12:28:23.636061	TCP	2051078	ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com)	49790	443	192.168.2.17	31.41.44.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:26:27.699274063 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.699317932 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:27.699390888 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.699696064 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.699707985 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:27.700234890 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.700314999 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:27.700388908 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.700689077 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:27.700716972 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.182312965 CEST	49677	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:28.182333946 CEST	49676	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:28.182334900 CEST	49678	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:28.775844097 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.776181936 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.776243925 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.777802944 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.777903080 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.778316021 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.778561115 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.778584957 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.779124022 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.779262066 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.779318094 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.780111074 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.780194998 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.781061888 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.781199932 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.820260048 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.820286989 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.836249113 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.836273909 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:28.868264914 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:28.884236097 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.142764091 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.143034935 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.144392967 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.144392967 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.186783075 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.228116989 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.457362890 CEST	49702	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.457428932 CEST	443	49702	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.540569067 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.540818930 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:29.540884972 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.541642904 CEST	49701	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:29.541656017 CEST	443	49701	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:30.725954056 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:30.725997925 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:30.726072073 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:30.726353884 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:30.726376057 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.096654892 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.096949100 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.096967936 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.098683119 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.098813057 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.104949951 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.105045080 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.105135918 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.105149984 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.157344103 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.917679071 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.917850971 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.917926073 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.917954922 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.918078899 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.918142080 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.918368101 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.918387890 CEST	443	49704	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.918399096 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.918534040 CEST	49704	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.919552088 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.919639111 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:31.919744015 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.919956923 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:31.919996023 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:32.275279045 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:32.275590897 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:32.275654078 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:32.276145935 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:32.276560068 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:32.276657104 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:32.322279930 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.828741074 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.872152090 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:37.953958988 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.954097033 CEST	443	49705	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:37.954180002 CEST	49705	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.954845905 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.954885006 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:37.954998970 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.955215931 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:37.955233097 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.082927942 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.082982063 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.083066940 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.083389044 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.083410025 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.275353909 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.275401115 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.275532007 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.275729895 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.275744915 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.313986063 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.314259052 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.314285040 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.315721989 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.315834045 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.316086054 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.316179037 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.316199064 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.360148907 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.368357897 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.368376017 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.416331053 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.441320896 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.441631079 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.441648960 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.442321062 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.442711115 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.442804098 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.496370077 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.578097105 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.578291893 CEST	443	49706	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.578387976 CEST	49706	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.578814030 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.624159098 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.628319979 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.628607988 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.628627062 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.629611969 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.629709959 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.630033970 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.630090952 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.672344923 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.672363043 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.720336914 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.754257917 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.754439116 CEST	443	49707	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.754585028 CEST	49707	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.755244970 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.796273947 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:38.796320915 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:38.796459913 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:38.798229933 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:38.798245907 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:38.800120115 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.945198059 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.945297003 CEST	443	49708	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.945377111 CEST	49708	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.946291924 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.946338892 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:38.946444988 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.946715117 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:38.946736097 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.089066982 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.089112997 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.089230061 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.089426994 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.089446068 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.246279955 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.246357918 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.246476889 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.246731997 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.246762037 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.309487104 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.309789896 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.309817076 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.313123941 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.313227892 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.313512087 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.313600063 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.313638926 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.354352951 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.354368925 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.402503014 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.444154024 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.444534063 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.444566011 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.444848061 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.445322990 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.445385933 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.483540058 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.483705997 CEST	443	49710	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.483798027 CEST	49710	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.484395027 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.532124996 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.600996017 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.601375103 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.601403952 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.602376938 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.602473021 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.603127003 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.603183031 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.610364914 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.610477924 CEST	443	49711	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.610537052 CEST	49711	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.611021042 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.611032963 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.655339956 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.712795973 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:39.712908030 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:39.715264082 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:39.715290070 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:39.715718031 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:39.767368078 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:39.787483931 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:39.817678928 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.817816973 CEST	443	49713	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.817889929 CEST	49713	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.819251060 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.819294930 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.819381952 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.819592953 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.819610119 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.828138113 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:39.946257114 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.946295023 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.946382999 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.946765900 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:39.946780920 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:39.965660095 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:40.056931973 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.056977987 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.057070971 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.057329893 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.057349920 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.127083063 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:40.127984047 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:40.128089905 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:40.128149986 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:40.128227949 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:40.182924032 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.183244944 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.183268070 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.184874058 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.184951067 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.185303926 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.185383081 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.185456991 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.185465097 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.225366116 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.303154945 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.303553104 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.303576946 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.303884029 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.304399014 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.304455042 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.351422071 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.415244102 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.415601969 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.415657997 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.417407036 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.417493105 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.417849064 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.417937040 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.463351965 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.463372946 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.511363983 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.593254089 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593288898 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593297005 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593342066 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593355894 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593369007 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593424082 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.593461037 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593492985 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593514919 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.593519926 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.593561888 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.593610048 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.612262964 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.612262964 CEST	49709	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:26:40.612303019 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.612328053 CEST	443	49709	40.127.169.103	192.168.2.17
Apr 24, 2024 12:26:40.956096888 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.956141949 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.956394911 CEST	443	49715	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.956485987 CEST	49715	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.987144947 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.987236977 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.987404108 CEST	443	49716	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:40.987466097 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:40.987466097 CEST	49716	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.056155920 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.082130909 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.082175016 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.082232952 CEST	443	49718	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.082295895 CEST	49718	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.161798000 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.161823988 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.161931992 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.162201881 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.162214994 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.518136024 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.518484116 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.518506050 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.519615889 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.519711018 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.520149946 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.520243883 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.520308971 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.564116001 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.573416948 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.573432922 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.621372938 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.722371101 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.722498894 CEST	443	49721	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:41.722654104 CEST	49721	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:41.925601959 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.925646067 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:41.925730944 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.925990105 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.926002979 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:41.927496910 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.927531958 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:41.927603960 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.927819967 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:41.927834988 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:42.816935062 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:42.996354103 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:42.996695042 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:42.996725082 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:42.997822046 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:42.997917891 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.003261089 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.003384113 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.003479958 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.003493071 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.003706932 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.003998995 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.004018068 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.005640984 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.005726099 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.006725073 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.006839991 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.056416035 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.056421041 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.056432962 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.103679895 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.119903088 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:43.368158102 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.368297100 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.368366957 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.369277954 CEST	49722	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.369292974 CEST	443	49722	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.435404062 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.476126909 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.587260008 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.587318897 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.587444067 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.587703943 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.587721109 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.725403070 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:43.787185907 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.787269115 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.787530899 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.788058996 CEST	49723	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:43.788077116 CEST	443	49723	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:43.943056107 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.943440914 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.943476915 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.944960117 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.945050955 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.945452929 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.945564032 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:43.945642948 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:43.945653915 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:44.006396055 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:44.622055054 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:44.622219086 CEST	443	49725	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:44.622319937 CEST	49725	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:44.935388088 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:45.207257986 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.207289934 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.207396984 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.208841085 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.208854914 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.550373077 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.550489902 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.553822041 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.553832054 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.554240942 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.597016096 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.644108057 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.864278078 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.864376068 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.864435911 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.864507914 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.864526033 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.864541054 CEST	49726	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.864547014 CEST	443	49726	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.897850990 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.897897005 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:45.897984982 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.898359060 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:45.898375034 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.227557898 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.227708101 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.229329109 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.229360104 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.229684114 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.231221914 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.276115894 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.482120991 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.482212067 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.482321978 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.482542992 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.482577085 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.546678066 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.546880960 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.547550917 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.547588110 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.547595978 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.547605991 CEST	49727	443	192.168.2.17	23.32.230.129
Apr 24, 2024 12:26:46.547610998 CEST	443	49727	23.32.230.129	192.168.2.17
Apr 24, 2024 12:26:46.842417002 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.842767000 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.842784882 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.844377041 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.844470978 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.844865084 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.844940901 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.870567083 CEST	49729	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:46.871073961 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:46.893416882 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.893443108 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:46.941415071 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:46.974505901 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:46.974904060 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:47.207631111 CEST	80	49729	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.207747936 CEST	49729	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.207945108 CEST	49729	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.211597919 CEST	80	49730	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.211674929 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.275613070 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:47.312629938 CEST	80	49731	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.312736988 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.339437962 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:47.570799112 CEST	80	49729	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.570884943 CEST	49729	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.572388887 CEST	49729	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.573347092 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.573370934 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.573487043 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.573645115 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:47.573652983 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:47.880386114 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:47.909221888 CEST	80	49729	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.277096987 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.277380943 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:48.277391911 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.277874947 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.278217077 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:48.278304100 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:48.278307915 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.324127913 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:48.326455116 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:49.018013954 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:49.018260956 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:49.018337965 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:49.018903971 CEST	49732	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:26:49.018918991 CEST	443	49732	31.41.44.109	192.168.2.17
Apr 24, 2024 12:26:49.094449997 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:51.506472111 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:52.141469002 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:26:53.183155060 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.224164963 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.793571949 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.793653965 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.793730974 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.793742895 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.793807983 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.794239044 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.794287920 CEST	443	49728	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.794349909 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.794349909 CEST	49728	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.795419931 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.795449018 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:53.795582056 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.795825005 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:53.795840025 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.157341003 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.157665014 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.157685995 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.158773899 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.159132957 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.159223080 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.159229994 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.159301043 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.210493088 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.513514996 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.513694048 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.513772011 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.513783932 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.513813019 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.513868093 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.513945103 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.514127970 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:54.514194012 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.514415979 CEST	49733	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:26:54.514431000 CEST	443	49733	142.250.141.106	192.168.2.17
Apr 24, 2024 12:26:55.946953058 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:55.947073936 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:55.947232008 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:55.947345018 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:55.947448015 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:56.106548071 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.106693029 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.106709957 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.106722116 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.106733084 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.106807947 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:56.266206026 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 24, 2024 12:26:56.266304016 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:26:56.313544989 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:26:56.604007959 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:56.604119062 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:56.604229927 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:56.605226040 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:56.605262041 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:56.757896900 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:56.757946968 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:56.758035898 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:56.793730021 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:56.793764114 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.122260094 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.122350931 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.171541929 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.171586990 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.172461033 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.174181938 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.174256086 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.174349070 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.314735889 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.314834118 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.318345070 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.318356991 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.318561077 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.358751059 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.400162935 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556175947 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556247950 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556332111 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556353092 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.556385040 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556531906 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556586027 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.556591988 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556602955 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556626081 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.556868076 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.556929111 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.565876961 CEST	49735	443	192.168.2.17	13.107.5.88
Apr 24, 2024 12:26:57.565900087 CEST	443	49735	13.107.5.88	192.168.2.17
Apr 24, 2024 12:26:57.617080927 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617141008 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617223978 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617264986 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.617300034 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617326975 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.617361069 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617409945 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.617908001 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.617938042 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.617965937 CEST	49734	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.617980003 CEST	443	49734	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.707927942 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.707992077 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:57.708086014 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.708329916 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:57.708347082 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.230288029 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.230403900 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.241674900 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.241693020 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.242017984 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.242569923 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.242602110 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.242659092 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.705585957 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.705647945 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.705686092 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.705723047 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.705748081 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.705768108 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.705879927 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.706063032 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.706085920 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.706096888 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.706096888 CEST	49736	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.706104040 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.706110954 CEST	443	49736	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.757177114 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.757215977 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:58.757328987 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.757514000 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:58.757524014 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.281426907 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.282113075 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.282140970 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.283175945 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.283181906 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.283226967 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.283236027 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.682750940 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.682785988 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.682830095 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.682898045 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.682934046 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.682959080 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.682959080 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.683399916 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.683415890 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.683442116 CEST	49737	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.683448076 CEST	443	49737	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.744277954 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.744329929 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:26:59.744417906 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.744687080 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:26:59.744704008 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.266072035 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.266871929 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.266899109 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.267996073 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.268001080 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.268057108 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.268065929 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674746037 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674778938 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674839020 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674880028 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.674909115 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674923897 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.674953938 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.674987078 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.675389051 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.675405979 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.675415039 CEST	49738	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.675421000 CEST	443	49738	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.731018066 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.731056929 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.731153965 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.731324911 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:00.731332064 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:00.743408918 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.743438005 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:00.743534088 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.743968010 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.743978977 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:00.757601976 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.757659912 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:00.757766962 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.757980108 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:00.757999897 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.242525101 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.243185997 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.243201971 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.244636059 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.244641066 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.244709969 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.244716883 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.453015089 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.453336954 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.453353882 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.453831911 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.454149961 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.454227924 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.454274893 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.461821079 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.462130070 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.462163925 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.462522984 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.463044882 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.463104963 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.500121117 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:01.507524014 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.507632017 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:01.644676924 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.644695044 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.644731998 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.644778013 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.644844055 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.644973040 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.645318985 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.645333052 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.645365000 CEST	49739	443	192.168.2.17	20.190.190.129
Apr 24, 2024 12:27:01.645370960 CEST	443	49739	20.190.190.129	192.168.2.17
Apr 24, 2024 12:27:01.745579004 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 24, 2024 12:27:01.891493082 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:01.891582966 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:01.891694069 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:01.894685984 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:01.894723892 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.200786114 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:02.200867891 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:02.200939894 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:02.201849937 CEST	49740	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:02.201864004 CEST	443	49740	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:02.382917881 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.383040905 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.383656025 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.383718967 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.444139957 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.444161892 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.444434881 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.444525957 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.446971893 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.447012901 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.465900898 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.465935946 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.466012001 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.466340065 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.466355085 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.807041883 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.807063103 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.807136059 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.807180882 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.807238102 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.807251930 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.807276011 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.807316065 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.807316065 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.814147949 CEST	49742	443	192.168.2.17	204.79.197.200
Apr 24, 2024 12:27:02.814186096 CEST	443	49742	204.79.197.200	192.168.2.17
Apr 24, 2024 12:27:02.822256088 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.822725058 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.822734118 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.823059082 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.823647022 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.823705912 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:02.823824883 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:02.864132881 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.866586924 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.866648912 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.866713047 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.866719007 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.866765976 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.867433071 CEST	49743	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.867446899 CEST	443	49743	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.868736029 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.868755102 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:03.868861914 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.869117022 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:03.869127989 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:04.223400116 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:04.223778963 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:04.223798037 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:04.224082947 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:04.224488974 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:04.224543095 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:04.276585102 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:05.326256037 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.328485012 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.328511953 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.328927040 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.328927040 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.328965902 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.372123003 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.688457012 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.688564062 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.688636065 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.689245939 CEST	49741	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:05.689275980 CEST	443	49741	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:05.918611050 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 24, 2024 12:27:06.025954008 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:06.026388884 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:06.026413918 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:06.026751995 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:06.027200937 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:06.027266026 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:06.076669931 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:06.396106958 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:06.444118977 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.079863071 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.079927921 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.080005884 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.080051899 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.080126047 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.080519915 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.080533028 CEST	443	49744	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.080579996 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.080579996 CEST	49744	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.081675053 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.081702948 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.081789970 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.082010984 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.082020998 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.442851067 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.443228006 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.443244934 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.443701982 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.444017887 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.444088936 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.444149971 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.490603924 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.490616083 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.802830935 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.802871943 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.802891970 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.802984953 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.803016901 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.803052902 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:07.803073883 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.803116083 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.803530931 CEST	49746	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:07.803548098 CEST	443	49746	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:09.545752048 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.547849894 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.547894955 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:09.547991991 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.548258066 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.548274994 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:09.592116117 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:09.905299902 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:09.905379057 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:09.905446053 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.905935049 CEST	49745	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:09.905957937 CEST	443	49745	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:10.258244038 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:10.258649111 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:10.258668900 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:10.259202003 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:10.259644985 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:10.259771109 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:10.300643921 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:10.607681036 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:10.607727051 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.607819080 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:10.608012915 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:10.608030081 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.970122099 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.970443964 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:10.970468998 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.970918894 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.971227884 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:10.971308947 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:10.971354961 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:11.012121916 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:11.019648075 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:11.772416115 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:11.772520065 CEST	443	49748	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:11.772619963 CEST	49748	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:12.128365040 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.128848076 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.128879070 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.128968954 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.129173040 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.129188061 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.176117897 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.495475054 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.495711088 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.495795012 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.496193886 CEST	49747	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.496207952 CEST	443	49747	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.831582069 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.831953049 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.831964970 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.832288027 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.832664967 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.832720041 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:12.886687994 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:12.978559017 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:12.978590012 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:12.978784084 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:12.979049921 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:12.979064941 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.336927891 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.337483883 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.337498903 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.338531971 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.338999987 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.338999987 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.339062929 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.339121103 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.378717899 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.378727913 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.382565975 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.382627964 CEST	443	49750	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:13.382787943 CEST	49750	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:13.625030041 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.625885963 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.625926018 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:13.626056910 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.626272917 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.626286983 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:13.672116995 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:13.988070965 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:13.988154888 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:13.988210917 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.988934040 CEST	49749	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:13.988950968 CEST	443	49749	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:14.331134081 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:14.331541061 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:14.331554890 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:14.331959009 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:14.332263947 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:14.332341909 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:14.382649899 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:14.408025980 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.408050060 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.408133030 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.408394098 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.408406973 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.765054941 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.765433073 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.765459061 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.766895056 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.767010927 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.767402887 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.767479897 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.767591000 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:14.767605066 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:14.812670946 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.706204891 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:15.706276894 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:15.706362009 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:15.706382036 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.706429958 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.706984997 CEST	49752	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.707015991 CEST	443	49752	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:15.708317041 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.708349943 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:15.708432913 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.708741903 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:15.708758116 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:16.065963984 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:16.066292048 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:16.066314936 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:16.066771030 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:16.067084074 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:16.067173958 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:16.115724087 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:17.059012890 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:17.059061050 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:17.059185028 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:17.059668064 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:17.059684038 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:17.554197073 CEST	80	49730	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:17.554332972 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:17.651562929 CEST	80	49731	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:17.651705980 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:17.948262930 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:17.948416948 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:17.950628996 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:17.950637102 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:17.950968981 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:17.956156015 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.000129938 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.212856054 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.215792894 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.215820074 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.215925932 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.216197968 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.216209888 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.260121107 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.574558020 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.574733019 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.574842930 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.575422049 CEST	49751	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.575437069 CEST	443	49751	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.829005003 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829021931 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829060078 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829159021 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.829178095 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829227924 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829252958 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.829263926 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829308033 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.829313040 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.829369068 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.833254099 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.833272934 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.833296061 CEST	49754	443	192.168.2.17	40.127.169.103
Apr 24, 2024 12:27:18.833302975 CEST	443	49754	40.127.169.103	192.168.2.17
Apr 24, 2024 12:27:18.929204941 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.929528952 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.929546118 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.929938078 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.930320024 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:18.930398941 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:18.983671904 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:19.383522987 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:19.424130917 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.071785927 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.071954012 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.072037935 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.072082996 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.072168112 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.072232008 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.072571993 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.072593927 CEST	443	49753	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.072630882 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.072673082 CEST	49753	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.073903084 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.073952913 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.074054956 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.074309111 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.074323893 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.429986000 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.430351973 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.430365086 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.431145906 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.431622028 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.431680918 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:20.480715036 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:20.647809982 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:20.649930000 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:20.649971962 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:20.650094986 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:20.650461912 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:20.650475025 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:20.688194036 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.013636112 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.013739109 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.013827085 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:21.014298916 CEST	49755	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:21.014314890 CEST	443	49755	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.188415051 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.232131004 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.355998993 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.356317043 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:21.356329918 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.357078075 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.357398987 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:21.357521057 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:21.407877922 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:21.876698017 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.876775980 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.876838923 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.876851082 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.876864910 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.876924038 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.877543926 CEST	49756	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.877561092 CEST	443	49756	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.879122019 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.879160881 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:21.879244089 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.879530907 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:21.879545927 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.239166021 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.239564896 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:22.239578009 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.240730047 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.241302013 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:22.241489887 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:22.241502047 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.284143925 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.286758900 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:22.350684881 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:22.350820065 CEST	443	49758	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:22.350884914 CEST	49758	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:24.514691114 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.515377998 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.515424967 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:24.515492916 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.515856028 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.515873909 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:24.560112953 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:24.878464937 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:24.878546953 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:24.878647089 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.879409075 CEST	49757	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:24.879429102 CEST	443	49757	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:25.221956015 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:25.222287893 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:25.222300053 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:25.223035097 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:25.223349094 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:25.223485947 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:25.269849062 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:26.197037935 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.197101116 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.197201014 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.197423935 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.197443962 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.556389093 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.556713104 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.556730032 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.558187008 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.558283091 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.558917046 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.559003115 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.559140921 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:26.559154987 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:26.608782053 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:27.456882954 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:27.457012892 CEST	443	49760	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:27.457093000 CEST	49760	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:30.600744963 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.602485895 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.602536917 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:30.602649927 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.602888107 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.602904081 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:30.648119926 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:30.959024906 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:30.959140062 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:30.959201097 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.959920883 CEST	49759	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:30.959944963 CEST	443	49759	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:31.310839891 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:31.311350107 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:31.311386108 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:31.312555075 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:31.313003063 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:31.313174009 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:31.353838921 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:32.219124079 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.219168901 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.219274044 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.219575882 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.219594002 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.575721979 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.576108932 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.576141119 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.578286886 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.578387976 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.578792095 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.579483986 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.631901026 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:32.631937027 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:32.679891109 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:34.076545954 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.079314947 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.079390049 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.079510927 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.079732895 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.079762936 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.120141029 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.438941956 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.439030886 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.439097881 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.439673901 CEST	49762	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.439693928 CEST	443	49762	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.785835981 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.786154032 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.786181927 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.786499977 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.786823034 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.786890030 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:34.835844994 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:34.924514055 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:34.968127966 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:35.411675930 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:35.411812067 CEST	443	49763	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:35.411876917 CEST	49763	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:38.262687922 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.263586044 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.263617992 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.263712883 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.263978004 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.263994932 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.304122925 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.625061035 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.625150919 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.625225067 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.625860929 CEST	49764	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.625889063 CEST	443	49764	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.977704048 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.978189945 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.978203058 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.980345964 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:38.980849028 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:38.981038094 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:39.020878077 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:39.561412096 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.561456919 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.561546087 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.562002897 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.562031984 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.927223921 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.927542925 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.927584887 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.931184053 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.931308031 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.931581974 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.931709051 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.931720972 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.931757927 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:39.980885983 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:39.980905056 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.028949976 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.945801020 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.945979118 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.946082115 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.946113110 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.946149111 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.946201086 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.946506023 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.946521997 CEST	443	49766	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.946537018 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.946578979 CEST	49766	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.947915077 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.947956085 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:40.948074102 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.948249102 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:40.948266983 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:41.310856104 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:41.311300039 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:41.311314106 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:41.312452078 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:41.312943935 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:41.313028097 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:41.352885008 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:47.260762930 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.260762930 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.261193037 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.262490034 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.262521029 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.262625933 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.262876987 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.262902021 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.308110952 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.405606985 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.405819893 CEST	443	49765	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.406076908 CEST	49765	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.407948017 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.408001900 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.409537077 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.409573078 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.409655094 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.410001040 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.410018921 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.601308107 CEST	80	49730	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.601458073 CEST	49730	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.745893955 CEST	80	49731	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.746045113 CEST	49731	80	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.966942072 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.967348099 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.967361927 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.968255043 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.968358040 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.968717098 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.968775034 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:47.968904972 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:47.968914032 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.023998976 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.117465019 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.117837906 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.117868900 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.118344069 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.118674040 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.118752956 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.167987108 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.517786980 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.517903090 CEST	443	49769	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.518016100 CEST	49769	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.520262003 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.522500992 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.522550106 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.522635937 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.522877932 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.522896051 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.564155102 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.718259096 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.718369007 CEST	443	49770	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.718440056 CEST	49770	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.720920086 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.720961094 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:48.721035957 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.721342087 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:48.721354961 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.028146982 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.028183937 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.028274059 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.028477907 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.028491020 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.177504063 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.177597046 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.177680969 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.177946091 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.177982092 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.227797985 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.228117943 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.228135109 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.229617119 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.229707003 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.229975939 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.230056047 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.230119944 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.230129004 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.280992985 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.342099905 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.342186928 CEST	443	49771	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.342256069 CEST	49771	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.344201088 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.344233036 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.344311953 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.344620943 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.344635010 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.425082922 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.425437927 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.425465107 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.426979065 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.427057981 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.427408934 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.427488089 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.427556992 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.427562952 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.472958088 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.515768051 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.515918970 CEST	443	49772	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.516056061 CEST	49772	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.518018961 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.518045902 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.518115997 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.518435955 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.518451929 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.684303999 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.684384108 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.684504986 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.684895992 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.684922934 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.732609987 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.733005047 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.733055115 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.734247923 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.734337091 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.734688997 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.734761953 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.734848022 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.734873056 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.776029110 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.860784054 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.860951900 CEST	443	49773	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.861042023 CEST	49773	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.863039017 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.863063097 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.863153934 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.863460064 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.863471031 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.890240908 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.890571117 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.890634060 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.891693115 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.891792059 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.892210007 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.892282963 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.892380953 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:49.892399073 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:49.935002089 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.046962023 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.047085047 CEST	443	49774	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.047178984 CEST	49774	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.049299002 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.049336910 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.049423933 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.049624920 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.049639940 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.051222086 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.051563025 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.051574945 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.053241014 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.053337097 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.053639889 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.053715944 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.053767920 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.093967915 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.093975067 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.142000914 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.223673105 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.224004984 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.224015951 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.225516081 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.225600958 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.225873947 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.225951910 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.266969919 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.266978025 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.314982891 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.398401976 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.398742914 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.398772955 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.399297953 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.399620056 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.399703979 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.442002058 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.572067022 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.572398901 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.572478056 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.573574066 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.573683977 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.573983908 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.574059963 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.618020058 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.618060112 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.665996075 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.756985903 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.757340908 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.757364035 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.758414984 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.758501053 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.758778095 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.758835077 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.794924974 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.795017004 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.795089006 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.796117067 CEST	49775	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.796129942 CEST	443	49775	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.808993101 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:50.809015989 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:50.856972933 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:51.325820923 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:51.325989008 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:51.326057911 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:51.639475107 CEST	49768	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:27:51.639513969 CEST	443	49768	142.250.141.106	192.168.2.17
Apr 24, 2024 12:27:52.089097023 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.089145899 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.089230061 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.089458942 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.089478016 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.089999914 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.090058088 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.090131998 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.090296984 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.090323925 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.794064999 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.794351101 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.794379950 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.794682026 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.795001030 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.795068979 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.795135975 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.795840025 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.796087980 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.796107054 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.797240019 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.797585964 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:52.797759056 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.836117029 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:52.842093945 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:53.540654898 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:53.540733099 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:27:53.540842056 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:53.541893959 CEST	49781	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:27:53.541917086 CEST	443	49781	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.494749069 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.497785091 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.497827053 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.497906923 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.498229027 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.498244047 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.540111065 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.857341051 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.857434988 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:13.857495070 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.858140945 CEST	49780	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:13.858159065 CEST	443	49780	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:14.203461885 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:14.203910112 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:14.203946114 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:14.204777002 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:14.205188036 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:14.205312014 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:14.252187967 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:14.301712036 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.301753044 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.301835060 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.302243948 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.302261114 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.656984091 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.657291889 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.657309055 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.657820940 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.658217907 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.658288002 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:14.658370018 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:14.704133034 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:15.094183922 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:15.094270945 CEST	443	49784	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:15.094340086 CEST	49784	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:16.564019918 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.564476013 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.564527988 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:16.564610958 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.564856052 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.564873934 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:16.604132891 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:16.928023100 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:16.928136110 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:16.928230047 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.929032087 CEST	49783	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:16.929055929 CEST	443	49783	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:17.230447054 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.230483055 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.230573893 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.230922937 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.230935097 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.271145105 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:17.271483898 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:17.271503925 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:17.271984100 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:17.272320032 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:17.272403002 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:17.321198940 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:17.585153103 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.585463047 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.585517883 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.587013960 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.587091923 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.587364912 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.587441921 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.587501049 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:17.587512016 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:17.640239954 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.489834070 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.489938021 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.490022898 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.490118980 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.490118980 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.490700960 CEST	49786	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.490721941 CEST	443	49786	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.492232084 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.492276907 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.492360115 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.492609978 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.492630005 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.848088026 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.848496914 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.848512888 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.848974943 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.849464893 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:18.849543095 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:18.900324106 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:20.104569912 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.106729031 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.106770039 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.106873035 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.107171059 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.107188940 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.148128033 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.468147993 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.468257904 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.468322992 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.468786001 CEST	49785	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.468806028 CEST	443	49785	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.564124107 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.564301014 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.564467907 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.739593983 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.739665031 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.739738941 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.817203999 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.817544937 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.817564011 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.817912102 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.818227053 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.818301916 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.859256029 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:20.914176941 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.914252043 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:20.914338112 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.011063099 CEST	49776	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.011076927 CEST	49777	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.011086941 CEST	443	49776	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.011101961 CEST	443	49777	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.011112928 CEST	49778	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.011130095 CEST	443	49778	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.098571062 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.098660946 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.098778009 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.486480951 CEST	49779	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:21.486515045 CEST	443	49779	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:21.486640930 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:21.528125048 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158107996 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158153057 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158246994 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.158262968 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158332109 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158386946 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.158915043 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.158927917 CEST	443	49787	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.158951044 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.158992052 CEST	49787	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.160685062 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.160721064 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.160866976 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.161128044 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.161144018 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.522320986 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.522764921 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.522777081 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.523689032 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.524014950 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.524133921 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.524167061 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.533282042 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:22.533304930 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.533391953 CEST	443	49789	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:22.533461094 CEST	49789	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:23.634222984 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:23.635595083 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:23.635622025 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:23.635705948 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:23.636060953 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:23.636075020 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:23.676124096 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.001549006 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.001715899 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.001810074 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:24.002552032 CEST	49788	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:24.002571106 CEST	443	49788	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.343135118 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.343533039 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:24.343553066 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.344753027 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.345061064 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:24.345246077 CEST	443	49790	31.41.44.109	192.168.2.17
Apr 24, 2024 12:28:24.392266989 CEST	49790	443	192.168.2.17	31.41.44.109
Apr 24, 2024 12:28:26.598356962 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.598375082 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.598463058 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.598830938 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.598849058 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.953341961 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.953665018 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.953685999 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.954726934 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.954807997 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.955195904 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.955262899 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.955290079 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.996129036 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:26.997311115 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:26.997322083 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:27.045340061 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:27.527296066 CEST	49791	443	192.168.2.17	142.250.141.106
Apr 24, 2024 12:28:27.527456999 CEST	443	49791	142.250.141.106	192.168.2.17
Apr 24, 2024 12:28:27.527546883 CEST	49791	443	192.168.2.17	142.250.141.106

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:26:27.365374088 CEST	51626	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:27.365633011 CEST	55659	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:27.516558886 CEST	53	61481	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:27.532598972 CEST	53	53635	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:27.688855886 CEST	53	51626	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:27.698689938 CEST	53	55659	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:28.500030041 CEST	53	52417	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:30.571377039 CEST	58088	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:30.571540117 CEST	53577	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:30.725155115 CEST	53	58088	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:30.725210905 CEST	53	53577	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:41.735769987 CEST	54798	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:41.736118078 CEST	51778	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:41.890324116 CEST	53	54798	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:42.079513073 CEST	53	51778	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:45.475874901 CEST	53	53794	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:46.715517044 CEST	64519	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:46.715657949 CEST	61885	53	192.168.2.17	1.1.1.1
Apr 24, 2024 12:26:46.869693041 CEST	53	61885	1.1.1.1	192.168.2.17
Apr 24, 2024 12:26:46.869741917 CEST	53	64519	1.1.1.1	192.168.2.17
Apr 24, 2024 12:27:04.240094900 CEST	53	54527	1.1.1.1	192.168.2.17
Apr 24, 2024 12:27:26.636600971 CEST	53	49886	1.1.1.1	192.168.2.17
Apr 24, 2024 12:27:27.516343117 CEST	53	61651	1.1.1.1	192.168.2.17
Apr 24, 2024 12:27:44.193147898 CEST	138	138	192.168.2.17	192.168.2.255
Apr 24, 2024 12:27:55.051331997 CEST	53	56755	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 24, 2024 12:26:42.079668045 CEST	192.168.2.17	1.1.1.1	c230	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 12:26:27.365374088 CEST	192.168.2.17	1.1.1.1	0x39e8	Standard query (0)	funcallback.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:27.365633011 CEST	192.168.2.17	1.1.1.1	0x18e2	Standard query (0)	funcallback.com	65	IN (0x0001)	false
Apr 24, 2024 12:26:30.571377039 CEST	192.168.2.17	1.1.1.1	0x280f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.571540117 CEST	192.168.2.17	1.1.1.1	0xdca8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 24, 2024 12:26:41.735769987 CEST	192.168.2.17	1.1.1.1	0xdf13	Standard query (0)	debasesingle.life	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:41.736118078 CEST	192.168.2.17	1.1.1.1	0xb527	Standard query (0)	debasesingle.life	65	IN (0x0001)	false
Apr 24, 2024 12:26:46.715517044 CEST	192.168.2.17	1.1.1.1	0x9361	Standard query (0)	debasesingle.life	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:46.715657949 CEST	192.168.2.17	1.1.1.1	0x5fb8	Standard query (0)	debasesingle.life	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 12:26:27.688855886 CEST	1.1.1.1	192.168.2.17	0x39e8	No error (0)	funcallback.com	31.41.44.109	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.106	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.99	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.104	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725155115 CEST	1.1.1.1	192.168.2.17	0x280f	No error (0)	www.google.com	142.250.141.105	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:30.725210905 CEST	1.1.1.1	192.168.2.17	0xdca8	No error (0)	www.google.com		65	IN (0x0001)	false
Apr 24, 2024 12:26:41.890324116 CEST	1.1.1.1	192.168.2.17	0xdf13	No error (0)	debasesingle.life	31.41.44.109	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:26:46.869741917 CEST	1.1.1.1	192.168.2.17	0x9361	No error (0)	debasesingle.life	31.41.44.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

funcallback.com

https:

debasesingle.life

www.google.com

slscr.update.microsoft.com

fs.microsoft.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49729	31.41.44.109	80	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:26:47.207945108 CEST	432	OUT	GET / HTTP/1.1 Host: debasesingle.life Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 24, 2024 12:26:47.570799112 CEST	349	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 24 Apr 2024 10:26:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:26:47 GMT Location: https://debasesingle.life/ Vary: Accept-Encoding Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49730	31.41.44.109	80	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:27:17.554197073 CEST	212	IN	HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49731	31.41.44.109	80	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:27:17.651562929 CEST	212	IN	HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49702	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:28 UTC	658	OUT	GET / HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:29 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:26:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:26:28 GMT Vary: Accept-Encoding
2024-04-24 10:26:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49701	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:29 UTC	586	OUT	GET /favicon.ico HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://funcallback.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:29 UTC	143	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:26:29 GMT Content-Type: text/html Content-Length: 548 Connection: close
2024-04-24 10:26:29 UTC	548	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49704	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:31 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:31 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGNe8o7EGIjAXT4rb3xbiCqRHtnsGn04-IRpUpBS4ss8SL7kyqcgc4mh6LEHfPTBuCV3-cPCa89EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI17yjsQYQgfrF_QISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bRfExj__Ok2RIg8iPOq2lg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:26:31 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:26:31 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=PwRQlyYst-zdL3borMV-zJl71f1yilSOXybrTSJXHGixC_QqYGzzLmD_ERBAlZXSaQMYvwHpRFvEJhMxMvjZ4IQlLCDy23DsWmNfigi05b8JkH0nW_GG7lT6H3aEgLbBIvpI_cStBCGzTo6d7Ii3QMyT6RaGyJ6C5s9vt8A0sfg; expires=Thu, 24-Oct-2024 10:26:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:26:31 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49705	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:37 UTC	669	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Ff&oit=3&cp=9&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49706	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:38 UTC	671	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fde&oit=3&cp=10&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49707	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:38 UTC	672	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeb&oit=3&cp=11&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49708	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:38 UTC	673	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdeba&oit=3&cp=12&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49710	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:39 UTC	676	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebases&oit=3&cp=15&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49711	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:39 UTC	677	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesi&oit=3&cp=16&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49713	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:39 UTC	678	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesin&oit=3&cp=17&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49709	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:39 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZFdKoHn55bWTOl4&MD=xxnmnz36 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 10:26:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0b179854-d630-474e-82f8-9ffb3db2e328 MS-RequestId: 9ce30c89-7c57-4b14-8239-e022788f3f30 MS-CV: mHNNgSzBDkmlZM3N.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 10:26:40 GMT Connection: close Content-Length: 24490
2024-04-24 10:26:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-24 10:26:40 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49715	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:40 UTC	681	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle&oit=3&cp=20&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49716	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:40 UTC	682	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.&oit=3&cp=21&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49718	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:41 UTC	685	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.lif&oit=3&cp=24&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49721	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:41 UTC	686	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fdebasesingle.life&oit=3&cp=25&pgcl=4&gs_rn=42&psi=OhtPKuyMOBZH1AHQ&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49722	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:42 UTC	660	OUT	GET / HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:43 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:26:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:26:43 GMT Vary: Accept-Encoding
2024-04-24 10:26:43 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49723	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:43 UTC	590	OUT	GET /favicon.ico HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://debasesingle.life/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:43 UTC	143	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:26:43 GMT Content-Type: text/html Content-Length: 548 Connection: close
2024-04-24 10:26:43 UTC	548	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49725	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:43 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49726	23.32.230.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:45 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 10:26:45 UTC	509	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Length: 55 Cache-Control: public, max-age=247023 Date: Wed, 24 Apr 2024 10:26:45 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49727	23.32.230.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:46 UTC	212	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 10:26:46 UTC	510	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Length: 55 Cache-Control: public, max-age=246993 Date: Wed, 24 Apr 2024 10:26:46 GMT Connection: close X-CID: 2
2024-04-24 10:26:46 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49732	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:48 UTC	660	OUT	GET / HTTP/1.1 Host: debasesingle.life Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:49 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:26:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:26:48 GMT Vary: Accept-Encoding
2024-04-24 10:26:49 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49728	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:53 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:53 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGO28o7EGIjDtljd6pm1ZWjTPyWP32HQBGX3sXwOJ767OIF2wF2ku1c4DUPfehf0hMaorp38NKnIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI7byjsQYQ8aLiwwISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Fwl4OnmLzm8DX1pC-QXUdw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:26:53 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:26:53 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=BNnNwi1CyTKXLq9II5lSY3MW5U3A7xZ76sYCVs1vYS1CjDxnBnZmYIMF59bHMiZyMK_RWxgxXcFowj99bqTcPduLfATTWlX-PhHEtlSmijJy6Gxl_TXQkeVmsr4JmnMR7nSqmss8zFIS8FX8a-LGKC_WOy8cKLU__yZO_arUAuU; expires=Thu, 24-Oct-2024 10:26:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:26:53 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49733	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:54 UTC	823	OUT	GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGO28o7EGIjDtljd6pm1ZWjTPyWP32HQBGX3sXwOJ767OIF2wF2ku1c4DUPfehf0hMaorp38NKnIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:26:54 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:26:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3511 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:26:54 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 3f 63 6c 69 65 6e 74 3d 63 68 72 6f 6d 65 2d 6f 6d 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/complete/search?client=chrome-omn
2024-04-24 10:26:54 UTC	1255	IN	Data Raw: 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 Data Ascii: r web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recapt
2024-04-24 10:26:54 UTC	1255	IN	Data Raw: 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 Data Ascii: vior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">This page appe
2024-04-24 10:26:54 UTC	102	IN	Data Raw: 74 3d 30 26 61 6d 70 3b 67 73 5f 72 6e 3d 34 32 26 61 6d 70 3b 73 75 67 6b 65 79 3d 41 49 7a 61 53 79 42 4f 74 69 34 6d 4d 2d 36 78 39 57 44 6e 5a 49 6a 49 65 79 45 55 32 31 4f 70 42 58 71 57 42 67 77 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: t=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw<br></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49734	20.190.190.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-24 10:26:57 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-24 10:26:57 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Apr 2024 10:25:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: cae35d2e-4cd2-41dc-b879-1d1d0624ef53 PPServer: PPV: 30 H: PH1PEPF00011F25 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Apr 2024 10:26:57 GMT Connection: close Content-Length: 11391
2024-04-24 10:26:57 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.17	49735	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:57 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-04-24 10:26:57 UTC	433	IN	HTTP/1.1 200 OK Content-Length: 7285 Content-Type: application/json; charset=utf-8 ETag: -940117251_1139429057 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: 15f3172f-bdda-4c00-9fda-8f68d9a6a48b X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9AAD981597704CB99D433BF2A3DB544F Ref B: BY3EDGE0116 Ref C: 2024-04-24T10:26:57Z Date: Wed, 24 Apr 2024 10:26:56 GMT Connection: close
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 68 69 67 68 71 75 61 6c 69 74 79 63 61 70 74 75 72 65 63 22 2c 22 79 6f 61 6c 77 39 38 30 31 63 66 22 2c 22 79 6f 63 33 37 32 31 22 2c 22 61 61 74 65 73 31 32 31 22 2c 22 79 6f 63 61 6c 38 33 30 22 2c 22 65 6d 70 72 6f 37 30 32 22 2c 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 79 6f 79 70 70 31 31 37 22 2c 22 79 6f 79 70 70 35 36 31 22 2c 22 79 6f 70 68 6f 31 35 36 22 2c 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 79 6f 72 65 6d 37 38 32 22 2c 22 79 6f 72 65 6d 33 32 35 22 2c 22 79 6f 72 6f 6d 39 33 39 22 2c 22 79 6f 79 70 70 36 33 38 22 2c 22 79 6f 61 61 6f 77 63 34 36 63 66 22 2c 22 79 6f 35 35 36 22 2c 22 79 6f 61 61 6f 32 36 37 22 2c 22 79 6f 70 72 69 32 35 Data Ascii: {"Features":["highqualitycapturec","yoalw9801cf","yoc3721","aates121","yocal830","empro702","yonon248","contactsv2synconly","yoypp117","yoypp561","yopho156","ypromeless","yorem782","yorem325","yorom939","yoypp638","yoaaowc46cf","yo556","yoaao267","yopri25
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 2c 22 31 34 67 36 22 3a 22 61 61 74 65 73 31 32 31 22 2c 22 31 38 66 7a 22 3a 22 79 6f 63 61 6c 38 33 30 22 2c 22 31 68 6a 65 22 3a 22 65 6d 70 72 6f 37 30 32 22 2c 22 31 71 61 38 22 3a 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 31 77 6d 74 22 3a 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 32 69 77 6a 22 3a 22 79 6f 79 70 70 31 31 37 22 2c 22 32 6a 36 61 22 3a 22 79 6f 79 70 70 35 36 31 22 2c 22 32 6b 71 32 22 3a 22 79 6f 70 68 6f 31 35 36 22 2c 22 32 6c 61 64 22 3a 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 32 6f 63 64 22 3a 22 79 6f 72 65 6d 37 38 32 22 2c 22 32 72 65 6b 22 3a 22 79 6f 72 65 6d 33 32 35 22 2c 22 32 73 63 78 22 3a 22 79 6f 72 6f 6d 39 33 39 22 2c 22 32 74 70 33 22 3a 22 79 6f 79 70 70 36 33 38 22 2c 22 33 30 62 38 22 3a 22 Data Ascii: ,"14g6":"aates121","18fz":"yocal830","1hje":"empro702","1qa8":"yonon248","1wmt":"contactsv2synconly","2iwj":"yoypp117","2j6a":"yoypp561","2kq2":"yopho156","2lad":"ypromeless","2ocd":"yorem782","2rek":"yorem325","2scx":"yorom939","2tp3":"yoypp638","30b8":"
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 32 36 34 22 2c 22 35 39 30 71 22 3a 22 34 61 33 30 64 34 35 35 22 2c 22 35 39 67 67 22 3a 22 32 69 32 68 65 31 31 38 22 2c 22 35 39 67 6a 22 3a 22 34 64 65 35 67 35 34 32 22 2c 22 35 39 76 7a 22 3a 22 62 65 63 34 34 37 35 37 22 2c 22 35 61 39 73 22 3a 22 39 38 34 65 39 37 37 34 22 2c 22 35 61 74 6b 22 3a 22 35 35 35 64 37 39 37 38 22 2c 22 35 62 61 74 22 3a 22 65 6a 66 34 36 37 39 35 22 2c 22 35 63 70 66 22 3a 22 34 39 62 34 67 31 33 33 22 2c 22 35 63 72 73 22 3a 22 33 62 66 39 67 38 35 35 22 2c 22 35 64 77 37 22 3a 22 69 34 37 62 65 31 37 38 22 2c 22 35 65 74 36 22 3a 22 32 34 38 66 61 31 38 36 22 2c 22 35 66 6c 32 22 3a 22 68 35 31 66 30 33 34 32 22 2c 22 35 66 79 6f 22 3a 22 68 64 65 31 67 32 36 37 22 2c 22 35 66 79 71 22 3a 22 34 6a 6a 66 62 37 36 38 Data Ascii: 264","590q":"4a30d455","59gg":"2i2he118","59gj":"4de5g542","59vz":"bec44757","5a9s":"984e9774","5atk":"555d7978","5bat":"ejf46795","5cpf":"49b4g133","5crs":"3bf9g855","5dw7":"i47be178","5et6":"248fa186","5fl2":"h51f0342","5fyo":"hde1g267","5fyq":"4jjfb768
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 7d 7d 2c 7b 22 49 64 22 3a 22 59 6f 75 72 50 68 6f 6e 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 41 4f 57 43 34 36 22 3a 36 34 30 30 2c 22 41 41 4f 57 43 34 37 22 3a 37 34 30 30 2c 22 41 41 4f 57 43 36 31 22 3a 31 36 30 30 2c 22 41 41 4f 57 43 36 32 22 3a 32 36 30 30 2c 22 41 41 4f 57 43 36 33 22 3a 33 36 30 30 2c 22 41 69 72 70 6c 61 6e 65 4d 6f 64 65 53 74 61 74 75 73 22 3a 74 72 75 65 2c 22 41 75 74 6f 48 79 64 72 61 74 65 64 49 6d 61 67 65 73 43 6f 75 6e 74 22 3a 30 2c 22 43 61 6c 6c 69 6e 67 41 6c 74 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 45 76 65 6e 74 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 45 78 69 74 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 4f 53 53 65 72 76 69 63 69 6e 67 46 69 Data Ascii: }},{"Id":"YourPhone","Parameters":{"AAOWC46":6400,"AAOWC47":7400,"AAOWC61":1600,"AAOWC62":2600,"AAOWC63":3600,"AirplaneModeStatus":true,"AutoHydratedImagesCount":0,"CallingAltBluetoothPairingEvent":true,"CallingExitConfirmation":true,"CallingOSServicingFi
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 3a 74 72 75 65 2c 22 49 73 41 75 74 68 56 32 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4d 65 64 69 61 50 61 63 6b 43 68 65 63 6b 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 68 61 74 46 69 6c 74 65 72 54 6f 67 67 6c 65 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 73 65 6e 74 56 32 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 76 65 72 73 61 74 69 6f 6e 56 69 65 77 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 48 69 64 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 4d 75 74 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 50 69 6e 6e 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 Data Ascii: :true,"IsAuthV2Enabled":true,"MediaPackCheck":true,"MessagingChatFilterToggle":true,"MessagingConsentV2":true,"MessagingConversationView":true,"MessagingEnableHiding":true,"MessagingEnableMuting":true,"MessagingEnablePinning":true,"MessagingSearch":true,"
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 69 6e 67 54 6f 70 30 31 31 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 32 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 35 22 3a 74 72 75 65 2c 22 52 6f 6d 65 44 69 73 61 62 6c 65 64 22 3a 34 34 31 35 30 33 2c 22 53 65 63 75 72 65 43 6f 6e 74 65 6e 74 22 3a 74 72 75 65 2c 22 53 68 65 6c 6c 45 78 74 65 6e 64 65 64 4c 65 66 74 50 61 6e 65 22 3a 74 72 75 65 2c 22 54 65 73 74 46 65 61 74 75 72 65 32 22 3a 66 61 6c 73 65 2c 22 55 6e 69 76 65 72 73 61 6c 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 22 3a 74 72 75 65 2c 22 57 68 61 74 73 4e 65 77 43 4e 22 3a 74 72 75 65 2c 22 59 50 50 43 61 74 61 73 74 72 6f 70 68 69 63 45 72 72 6f 72 41 75 74 6f 52 65 73 65 74 22 3a 74 72 75 65 2c 22 59 50 50 43 6f 6e 73 65 63 75 74 69 76 Data Ascii: ingTop011":true,"RemotingTop012":true,"RemotingTop015":true,"RomeDisabled":441503,"SecureContent":true,"ShellExtendedLeftPane":true,"TestFeature2":false,"UniversalBluetoothPairing":true,"WhatsNewCN":true,"YPPCatastrophicErrorAutoReset":true,"YPPConsecutiv
2024-04-24 10:26:57 UTC	1024	IN	Data Raw: 79 6f 35 35 36 3a 33 30 39 38 36 35 35 36 3b 79 6f 61 61 6f 32 36 37 3a 33 30 34 33 34 36 37 32 3b 79 6f 70 72 69 32 35 37 3a 33 30 34 36 34 34 33 33 3b 79 6f 31 37 39 3a 33 30 34 34 35 33 31 30 3b 79 6f 69 73 61 38 36 31 3a 33 30 35 32 35 38 36 38 3b 79 6f 72 65 6d 31 34 31 3a 33 30 34 38 36 33 35 33 3b 79 6f 79 70 70 36 35 32 3a 33 30 35 31 35 34 38 33 3b 79 6f 35 32 35 3a 33 30 35 35 33 39 38 35 3b 79 6f 36 30 36 3a 33 30 35 32 37 38 35 30 3b 79 6f 6e 6f 74 36 33 33 3a 33 30 36 32 36 30 37 38 3b 79 6f 79 70 70 38 35 39 3a 33 30 36 38 37 38 35 39 3b 79 6f 69 6e 64 36 36 35 3a 33 30 35 39 35 31 36 33 3b 79 6f 64 63 67 38 33 30 3a 33 30 37 31 32 39 34 39 3b 6f 6e 6c 79 5f 74 6f 61 73 74 63 6f 6e 74 65 78 74 6d 65 6e 75 3a 33 30 36 34 38 30 38 31 3b 61 6a Data Ascii: yo556:30986556;yoaao267:30434672;yopri257:30464433;yo179:30445310;yoisa861:30525868;yorem141:30486353;yoypp652:30515483;yo525:30553985;yo606:30527850;yonot633:30626078;yoypp859:30687859;yoind665:30595163;yodcg830:30712949;only_toastcontextmenu:30648081;aj
2024-04-24 10:26:57 UTC	117	IN	Data Raw: 38 33 38 35 30 33 3b 35 30 63 37 39 31 30 36 3a 33 30 38 33 38 36 31 39 3b 6a 61 35 63 34 32 34 39 3a 33 31 30 30 36 32 34 34 3b 68 33 65 64 34 31 36 31 3a 33 30 38 39 31 37 38 34 3b 61 62 69 30 67 38 31 37 3a 33 30 39 35 32 38 37 35 3b 61 35 34 66 61 35 37 34 3a 33 30 39 39 33 33 34 39 3b 64 69 66 32 32 32 31 39 3a 33 30 39 36 30 34 30 32 3b 22 7d Data Ascii: 838503;50c79106:30838619;ja5c4249:31006244;h3ed4161:30891784;abi0g817:30952875;a54fa574:30993349;dif22219:30960402;"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49736	20.190.190.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-24 10:26:58 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-24 10:26:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Apr 2024 10:25:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 7d5590f9-c4b3-4739-8fa8-dca876c1e03e PPServer: PPV: 30 H: PH1PEPF00011D00 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Apr 2024 10:26:57 GMT Connection: close Content-Length: 11391
2024-04-24 10:26:58 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49737	20.190.190.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:26:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-24 10:26:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-24 10:26:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Apr 2024 10:25:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 45ee62a9-11be-4993-9a5e-44863309fedf PPServer: PPV: 30 H: PH1PEPF00011D49 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Apr 2024 10:26:58 GMT Connection: close Content-Length: 11371
2024-04-24 10:26:59 UTC	11371	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49738	20.190.190.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:00 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-24 10:27:00 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-24 10:27:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Apr 2024 10:26:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 4ff1a818-4dd7-414f-b944-ef7498a8b209 PPServer: PPV: 30 H: PH1PEPF00011CBE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Apr 2024 10:26:59 GMT Connection: close Content-Length: 11371
2024-04-24 10:27:00 UTC	11371	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49739	20.190.190.129	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-24 10:27:01 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-24 10:27:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Apr 2024 10:26:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: aa001367-2c07-4bc3-89dd-8ea8b2e891b3 PPServer: PPV: 30 H: PH1PEPF00011E4F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Apr 2024 10:27:01 GMT Connection: close Content-Length: 11153
2024-04-24 10:27:01 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49740	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:01 UTC	668	OUT	GET /9hFXWz7M HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:02 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:02 GMT Vary: Accept-Encoding
2024-04-24 10:27:02 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49742	204.79.197.200	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:02 UTC	2566	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAfJ5zkfP4NMtLPZKNffsE%2Bd4xusfhhTKPBHjey4oI7ua7TdrbsZN2dsosPlDJqfdmpd8ZaX%2BRz5QrGHxmbOUdyXm0LXZpkbSLQs1Ot6cwGIpFwSc7G%2BJA1DrTa2d6OJTCdp7NSGGUS/zuGxRYPPdZB8YqA%2BQ/1BD54H7uaTuJlJjroqMtnGP%2BL6R/EURhNvaGIyhzC3i0RPkmIgURHAuoOQRsXBCZiOnH2KGSIpyrdn258D6J6eu9GjlNRBuNFAEFER8KrlRCVi8tLk8KvsIOzcbyyk7NK5YDTxcA9wMKIT6GfXaZRed%2BmMrBuWkIxo0XrFOurjtYvsuZEO4Pc/0mHQDZgAACJECrBrIRSZ5qAEhLLipcZ5obAtG3U5WIzBEpSO94xfz8IMug9wJ%2BylLX6%2BCGt1SehsxJJ8jE5WXwVricdUwEXJhQR414o6s2AkQsY8oQIsXmp3HREoPoIrMC7Fmme2HrpimR0HINS8%2BsvsSg75aPukjQIoe3ts0qvuYBvK56lUeSHDpHh0etTqftfkfyOv6kcbMyCsS/Cs855jwIx2S%2BiQbBjY33yp7AP7w71PhxfsX/zwdEXQd9lGVVH0KMZnueOlEd25fjzMnwjEOlQGHmcorSClCYdybpZLcJFKvTDzLo46Hi7ZynI5KzyOYCinVw1CXYwPlFTeuHdB81JEeoXjJnfXcc/UnXSI5B1bB4W892BWguFbCIVpad55L9LDEB814rr5uT%2BmitNpj4TQTQq4wZwCxCV6tYdgzi2E/BxFj5iJI4wPIrnoHrFoFlFkAm8k/h2%2Bz%2BsPaFHikD4uMm3EbvAPQY8wdGuigpaQIAHOWACgIGCbs7XxOfCiMUeHY8ahvBjHzuKh3GitDVovKbJKXJJZFq3JjvnjKt1gvt7vu2IoPNYkZN1T7g4YLnK5BVs5q2QE%3D%26p%3D X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1713954414 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: ADC09E9D713846698E8E4785EB55C0F1 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-04-24 10:27:02 UTC	1463	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=196729966EEF6A1E2ABE3DFD6F016B81&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=4590362BB5CF472B95BBEDB3112D4B7B; expires=Mon, 19-May-2025 10:27:02 GMT; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Mon, 19-May-2025 10:27:02 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=196729966EEF6A1E2ABE3DFD6F016B81; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 6628de765aac408cb74549b038927e45 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DA34DFD76FC54D039F24143BC47F5219 Ref B: LAX311000112051 Ref C: 2024-04-24T10:27:02Z Date: Wed, 24 Apr 2024 10:27:01 GMT Connection: close
2024-04-24 10:27:02 UTC	1498	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value
2024-04-24 10:27:02 UTC	717	IN	Data Raw: 7b 22 76 61 6c 75 65 22 3a 31 34 34 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 52 65 6d 69 6e 64 65 72 43 6f 75 6e 74 22 3a 7b 22 76 61 6c 75 65 22 3a 32 35 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 52 65 74 72 79 43 6f 75 6e 74 22 3a 7b 22 76 61 6c 75 65 22 3a 32 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4c 6f 63 61 6c 4e 65 77 42 61 74 63 68 53 69 7a 65 22 3a 7b 22 76 61 6c 75 65 22 3a 31 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 41 74 74 61 63 68 6d 65 6e 74 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 7b 22 76 61 6c 75 65 22 3a 33 30 37 30 30 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4c 6f 63 61 74 69 6f 6e 52 65 6d 69 6e 64 65 72 44 65 73 6b 74 6f 70 4f 6e 55 6e 6c 6f 63 6b 53 70 61 6e 22 3a Data Ascii: {"value":1440,"feature":""},"MaxReminderCount":{"value":250,"feature":""},"MaxRetryCount":{"value":2,"feature":""},"LocalNewBatchSize":{"value":1,"feature":""},"MaxAttachmentSizeInBytes":{"value":307000,"feature":""},"LocationReminderDesktopOnUnlockSpan":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49743	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:02 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:03 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGPe8o7EGIjCCVaS1o8lpVjew4gNGvhsf_sJnaJX8wEYwGfzwGZ5fhXJAvLIgwCxGPvM96UrLu40yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI97yjsQYQpqn02QISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-XU3D06QR-lmySAflFJy7yg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:03 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:03 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=HoIqTSW8iOWm7h2r-hHVm8pT4O_aqwUDpQ-XbMkJawockn7itUplAFtxOvAlW0I9-qK1m0yH9lq41gL6CQygsukS8nrIVVrQAUvZZ4bWa6KNOcYDQnPwBd0ebM5F_VrpiQnTqPiT9YRvXig0ZlHt9Zgyi1GeozqLdLaeDcqnhIQ; expires=Thu, 24-Oct-2024 10:27:03 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:03 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49741	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:05 UTC	668	OUT	GET /9hFAWz7M HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:05 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:05 GMT Vary: Accept-Encoding
2024-04-24 10:27:05 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49744	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:06 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:07 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGPq8o7EGIjCPZ7mLrGZOjiilg62h20hakliyrRjoptyj-G79OVFIZsyqFvdYeoEJ4nuR2vvBQHMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI-ryjsQYQobvSzQMSBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-9rMQQXIZLNAnCLdhUmRCmg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:06 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:06 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=BlrX0OpiuPWXgzUI4DWeqvbEuRg3q71pVMZhK9KKBx8aIacxw2fp4CX7hkelQFGE0PQo0gGDY7CmQf0xsVtSWWy3qnkhsQYb6A6IGf38IWWUnouChbVZGzJRdLJyhToN80If6UNmQ5iK9phmtb6hs5dAT0k1HPWZ7_bokfWft7E; expires=Thu, 24-Oct-2024 10:27:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:07 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49746	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:07 UTC	823	OUT	GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGPq8o7EGIjCPZ7mLrGZOjiilg62h20hakliyrRjoptyj-G79OVFIZsyqFvdYeoEJ4nuR2vvBQHMyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:07 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:27:07 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3511 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:07 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 3f 63 6c 69 65 6e 74 3d 63 68 72 6f 6d 65 2d 6f 6d 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/complete/search?client=chrome-omn
2024-04-24 10:27:07 UTC	1255	IN	Data Raw: 72 20 77 65 62 20 62 72 6f 77 73 65 72 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 Data Ascii: r web browser.</div></noscript><script src="https://www.google.com/recaptcha/api.js" async defer></script><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recapt
2024-04-24 10:27:07 UTC	1255	IN	Data Raw: 76 69 6f 72 2e 20 54 68 69 73 20 70 61 67 65 20 63 68 65 63 6b 73 20 74 6f 20 73 65 65 20 69 66 20 69 74 27 73 20 72 65 61 6c 6c 79 20 61 20 68 75 6d 61 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 72 65 71 75 65 73 74 73 20 61 6e 64 20 6e 6f 74 20 61 20 72 6f 62 6f 74 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 74 68 69 73 20 6e 65 74 77 6f 72 6b 2e 20 3c 62 72 3e 3c 62 72 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 66 6f 44 69 76 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 30 20 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 Data Ascii: vior. This page checks to see if it's really a human sending the requests and not a robot coming from this network. <br><br><div id="infoDiv" style="display:none; background-color:#eee; padding:10px; margin:0 0 15px 0; line-height:1.4em;">This page appe
2024-04-24 10:27:07 UTC	102	IN	Data Raw: 74 3d 30 26 61 6d 70 3b 67 73 5f 72 6e 3d 34 32 26 61 6d 70 3b 73 75 67 6b 65 79 3d 41 49 7a 61 53 79 42 4f 74 69 34 6d 4d 2d 36 78 39 57 44 6e 5a 49 6a 49 65 79 45 55 32 31 4f 70 42 58 71 57 42 67 77 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: t=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw<br></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49745	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:09 UTC	670	OUT	GET /9FGNGFNFGJ HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:09 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:09 GMT Vary: Accept-Encoding
2024-04-24 10:27:09 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49748	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:10 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49747	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:12 UTC	668	OUT	GET /9FGNGFNF HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:12 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:12 GMT Vary: Accept-Encoding
2024-04-24 10:27:12 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49750	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:13 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49749	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:13 UTC	664	OUT	GET /9FGN HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:13 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:13 GMT Vary: Accept-Encoding
2024-04-24 10:27:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49752	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:14 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:15 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIO9o7EGIjDhIlD9r_fX7_EF8G1Us97LI2gBOzRFSSX2ZrWGANS_X2RUBZcSlQzPMm40d8mwdHwyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIg72jsQYQ-vaFmwISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-qrEXT5sjZ-gXSqgZgIledQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:15 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:15 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=ePRyMlsgA0evH785cb4atEDCfUaAv9ntEtZ14UJCA8Nghr1eOHDPiFmOVO-I_9gmzWm51-TzOpLSvv_shTAja-cnvf2eq1BwQOok6lOFKLL-ezJnYae-9mS3U1WVcfbMcAvwUS9zwXGsp2sAphZ7MFvXbL5MmusAH1o8Zw783v8; expires=Thu, 24-Oct-2024 10:27:15 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:15 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49754	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:17 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZFdKoHn55bWTOl4&MD=xxnmnz36 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-24 10:27:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: a29bb5d3-fc20-49dd-96b6-233f55412862 MS-RequestId: 34321c39-e032-4f2d-9bf9-f6834fdafd2a MS-CV: JMaNcl8rUEym7xMa.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Apr 2024 10:27:18 GMT Connection: close Content-Length: 25457
2024-04-24 10:27:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-24 10:27:18 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49751	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:18 UTC	661	OUT	GET /a HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:18 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:18 GMT Vary: Accept-Encoding
2024-04-24 10:27:18 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49753	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:19 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:20 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIe9o7EGIjA4sRHdMzI0o_2FIdMqICVsR9jMAKSyzeLcoXHWL7gJOZhJEvWlVrVkab8SH9zbvToyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIh72jsQYQ6qCzxwMSBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-kcdoBCw0wxaRf_HtRgrL8A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:19 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:19 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=NpqOBGAji3zHKKg4I_ORjak6QV1Xg7WLaSHvCd0V0nYj2Y4qaAO9484yCzxh6kgvOwGqYgH0St503Zt31HIvztZ8lwAx24AOxqajALv7vNlXjlQKb3xHP9wz1cmfSFReDLackhVKSVTtG1R_mLzP1vJAhi9vKVlBhmAaVrq1ZUg; expires=Thu, 24-Oct-2024 10:27:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:20 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49755	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:20 UTC	663	OUT	GET /aDF HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:21 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:20 GMT Vary: Accept-Encoding
2024-04-24 10:27:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49756	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:21 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:21 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIm9o7EGIjCr71g2DaGKX03zfbOMRvZGitgHQ5gSzz1_UmYnoZc9EYAOncPgEW9ebhFc9F3QvQIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIib2jsQYQqqeV6wISBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Ra0PNQyKOOyiA-HuVaq-Bg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:21 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:21 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=hLRqF-3lvA8aUBCkgeqlZfwOhujd0OwInZOwWj2E9U82xqPNx3u7vPbGwIleA7rSL5C7nzk_XbpAUzvB4nLnDsCtGcXGCZ2boF7dnzmX9sk9zRdNH0OQeKu0dcIVBR4xrgHlyHS-f8CKOFExE7fR0uqVAOgGx-XlNJZBo15ymFU; expires=Thu, 24-Oct-2024 10:27:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:21 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49758	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:22 UTC	823	OUT	GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGIm9o7EGIjCr71g2DaGKX03zfbOMRvZGitgHQ5gSzz1_UmYnoZc9EYAOncPgEW9ebhFc9F3QvQIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	49757	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:24 UTC	661	OUT	GET /* HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:24 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:24 GMT Vary: Accept-Encoding
2024-04-24 10:27:24 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	49760	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:26 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	49759	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:30 UTC	669	OUT	GET /INDEX.PHP HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:30 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:30 GMT Vary: Accept-Encoding
2024-04-24 10:27:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	49762	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:34 UTC	665	OUT	GET /INDEX HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:34 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:34 GMT Vary: Accept-Encoding
2024-04-24 10:27:34 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	49763	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:34 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	49764	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:38 UTC	663	OUT	GET /all HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:38 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:38 GMT Vary: Accept-Encoding
2024-04-24 10:27:38 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	49766	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:39 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:40 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGJy9o7EGIjCsWKGhs-u0vI16Caoo5DDrKKGjnTnveDiyIn9jMjj_4IBXMx9EwkRLfw5WlCfMA7QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwInL2jsQYQq-HXjAMSBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-5q05QwBBzYqItx7ArWioJw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:27:40 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:27:40 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=K498v5slu7JHdvUYb782Lr5QS3za7R11ObXCmlMlph555SVp06eWc2z6iyyLF30x5xzj6T6QUACJUBhleMXV17GVrBLtHgA3ThSesvtLSAr2UjkDp6W0d1XskRY2Wg2HhZMJZrjFeIPcv7PtiLtjGO5bijZl8EJ2eNaACm2fZFg; expires=Thu, 24-Oct-2024 10:27:40 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:27:40 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	49765	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:47 UTC	665	OUT	GET /INDEX HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.17	49769	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:47 UTC	669	OUT	GET /INDEX.PHP HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	49770	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:48 UTC	661	OUT	GET /* HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	49771	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:49 UTC	668	OUT	GET /9FGNGFNF HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	49772	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:49 UTC	670	OUT	GET /9FGNGFNFGJ HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	49773	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:49 UTC	668	OUT	GET /9hFXWz7M HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	49774	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:49 UTC	660	OUT	GET / HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	49775	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:50 UTC	660	OUT	GET / HTTP/1.1 Host: debasesingle.life Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:50 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:50 GMT Vary: Accept-Encoding
2024-04-24 10:27:50 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	49781	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:27:52 UTC	658	OUT	GET / HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:27:53 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:27:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:27:53 GMT Vary: Accept-Encoding
2024-04-24 10:27:53 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	49780	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:13 UTC	667	OUT	GET /dsfdsfsgf HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:13 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:28:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:28:13 GMT Vary: Accept-Encoding
2024-04-24 10:28:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	49784	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:14 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	49783	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:16 UTC	662	OUT	GET /home HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:16 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:28:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:28:16 GMT Vary: Accept-Encoding
2024-04-24 10:28:16 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.17	49786	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:17 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:18 UTC	2172	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGMG9o7EGIjCqxAhdzrVbwnchyT7_n-J-TynXC2TiqS-p0oz9vZUFiPY4ikAeBi5FRipERDuSdIcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIwr2jsQYQqZ6aswESBJoQaSQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AdvHv6y6O9cgay25fg6_BQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:28:18 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:28:18 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=jY2jlEbnivu1kvgoqr4llZWhAP8R0VCmDMaZ2jQsUHvM9_ikaq_KyERKgy6w4qKrAupIsa7YnSrrfWtaOOklzhSBMz1T1JSExHcfaUeKSGpqtW4OAUNuo7fRm9-Ou5_uyV5Y23CERHDzStuWigSiTFZgHLNuieLCV8FZ5VQyhAc; expires=Thu, 24-Oct-2024 10:28:17 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:28:18 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.17	49785	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:20 UTC	663	OUT	GET /index HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:20 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:28:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:28:20 GMT Vary: Accept-Encoding
2024-04-24 10:28:20 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.17	49787	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:21 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:22 UTC	2171	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGMW9o7EGIjDoaiqIgJym7mPXMuk64a2_ECOop8aSMKF9PeWRy-JzRSbFSHqdq-5U6e7Bbe2Sn4MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsIxr2jsQYQxvSsFRIEmhBpJA Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gUzBGX3H1nzjV5ewo5uZNg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Wed, 24 Apr 2024 10:28:22 GMT Server: gws Content-Length: 554 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-24-10; expires=Fri, 24-May-2024 10:28:22 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=lHoVLwSHdgWM-qgi1MecsPL8QoogARD9o2muLPj9Avdx7qscB22QPegq_zJqm8OI3KZ1pHcpw9jLeF_PwXtGJFPeQK9ukoPZAikyZDZjMqERkwNwVkDBmZT7uhmIy074o4nsx3feuJWjY_H5kJVBP-RJsgnf8E03nJfV8SqXkgQ; expires=Thu, 24-Oct-2024 10:28:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 10:28:22 UTC	554	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 6f 6d 70 6c 65 74 65 2f 73 65 61 72 63 68 25 33 46 63 6c Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/complete/search%3Fcl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	49789	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:22 UTC	823	OUT	GET /sorry/index?continue=https://www.google.com/complete/search%3Fclient%3Dchrome-omni%26gs_ri%3Dchrome-ext-ansg%26xssi%3Dt%26q%3D%26oit%3D0%26gs_rn%3D42%26sugkey%3DAIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw&q=EgSaEGkkGMW9o7EGIjDoaiqIgJym7mPXMuk64a2_ECOop8aSMKF9PeWRy-JzRSbFSHqdq-5U6e7Bbe2Sn4MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.17	49788	31.41.44.109	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:23 UTC	661	OUT	GET /all HTTP/1.1 Host: funcallback.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 10:28:23 UTC	273	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Apr 2024 10:28:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 147 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 24 Apr 2024 10:28:23 GMT Vary: Accept-Encoding
2024-04-24 10:28:23 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.17	49791	142.250.141.106	443	5752	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:28:26 UTC	621	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCNy9zQEIksrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Target ID:	0
Start time:	12:26:25
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://funcallback.com/
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:26:25
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1908,i,7132797458047538153,14976899147334223984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: http://debasesingle.life/	Avira URL Cloud: Label: malware
Source: https://funcallback.com/favicon.ico	Avira URL Cloud: Label: malware
Source: https://debasesingle.life/favicon.ico	Avira URL Cloud: Label: malware

Source: http://debasesingle.life/	Virustotal: Detection: 17%	Perma Link
Source: debasesingle.life	Virustotal: Detection: 17%	Perma Link
Source: funcallback.com	Virustotal: Detection: 20%	Perma Link

Source: Traffic	Snort IDS: 2051077 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com) 192.168.2.17:51626 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051077 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (funcallback .com) 192.168.2.17:55659 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49702 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49701 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2050098 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) 192.168.2.17:54798 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2050098 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) 192.168.2.17:51778 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2050098 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) 192.168.2.17:64519 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2050098 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in DNS Lookup (debasesingle .life) 192.168.2.17:61885 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49781 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49780 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49783 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49785 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49788 -> 31.41.44.109:443
Source: Traffic	Snort IDS: 2051078 ET CURRENT_EVENTS TA569 Keitaro TDS Domain in TLS SNI (funcallback .com) 192.168.2.17:49790 -> 31.41.44.109:443

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://funcallback.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Static File Info

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 1100, Parent PID: 2984

General

Chronological Activities

Windows Analysis Report
https://funcallback.com