Edit tour

Windows Analysis Report
SetupPoker.exe

Overview

General Information

Sample name:	SetupPoker.exe
Analysis ID:	1431066
MD5:	343388c9516bc04f4ed06d6f1353f602
SHA1:	b124bf52a708dc990ed302519b434fac3565e190
SHA256:	33fe69e83c850f8b4b090b862cb38648a77c68f251cd6e9bd975ac2aa917ac05
Infos:

Detection

Score:	39
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Multi AV Scanner detection for submitted file

Writes many files with high entropy

Allocates memory with a write watch (potentially for evading sandboxes)

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Uses 32bit PE files

Classification

Analysis Advice

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64_ra

SetupPoker.exe (PID: 7012 cmdline: "C:\Users\user\Desktop\SetupPoker.exe" MD5: 343388C9516BC04F4ED06D6F1353F602)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SetupPoker.exe

Virustotal: Detection: 7%

Perma Link

Source: SetupPoker.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SetupPoker.exe

File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\WebInstaller_7012.log

Jump to behavior

Source: SetupPoker.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49833 version: TLS 1.2

Source: SetupPoker.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\repo\web-installer-new\WebInstaller\Release\WebInstaller.pdb source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SetupPoker.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.html	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1Accept: /User-Agent: WinClientHost: d3a6p9a3vksur7.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWluc3RhbGxlcl9pbml0Jm9zPSg5MjAwKV82NGJpdCZvc19sYW5nPTIwNTcmaWVfdmVyPTExLjc4OS4xOTA0MS4wJnByb2Nlc3NfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImdmVyaWZpZXI9YzBjMThlYWI0ZmI3ZWQ5NmJkMzM3ZGM2YmRmMGNmOTkmdXNlcl9pZD1DNDlGQkU2QjQ1MTc0OEE1QjM2RDFDMzJDQzI5RENCQiZpbnN0YWxsZXJfdmVyPTEuMS4xLjM2JnRpbWVzdGFtcD0xNzEzOTY2NTQ0NDM5JmFkbWludXNlcj0xJnN0YXJ0dGltZT0xNzEzOTY2NTQ0JmxpZmV0aW1lPTA%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU0ODc2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00 HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU1MzkxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05 HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU2MjYxNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xOA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU3MzE2MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0yOQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU4Njg0OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00Mg%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwMzE0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT01OQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwNjY0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Mg%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwODc5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02NA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMTE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Nw%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMzIyOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02OQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNDgzMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03MA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNjM3OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mg%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNzk0MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mw%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxOTUwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03NQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMTA4NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Nw%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMjY0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03OA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNDIyMiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNTc5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNzM1MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Mw%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyODkzNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04NA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMDQ5NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Ng%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMjA1OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMzYwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzNTIwNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05MQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzNjc1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05Mg%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzODMwMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzOTg2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NQ%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MTQ0MCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05Nw%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MzAwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05OA%3D%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NDU2NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDA%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NjE0NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDI%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NzcxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDM%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0OTI5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDU%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MDg1NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDY%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MjQwNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDg%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1Mzk4NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDk%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NTU1NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTE%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NzE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTM%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1ODcyMCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTQ%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MDI5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTY%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MTg4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTc%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MzQ0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTk%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NTAwOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjA%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NjU1MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjI%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2ODE4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjQ%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2OTc0NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjU%3D HTTP/1.1Accept: /User-Agent: WinClientHost: stats.ptinstaller.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: stats.ptinstaller.com
Source: global traffic	DNS traffic detected: DNS query: d3a6p9a3vksur7.cloudfront.net

Source: SetupPoker.exe, 00000000.00000003.1406630300.0000000004F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET
Source: SetupPoker.exe, 00000000.00000003.1191930955.000000000638D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1333495568.0000000006084000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1442450512.0000000006150000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1268648812.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006148000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1335493226.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1268165536.00000000061D2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1216617589.0000000006391000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.000000000614D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4
Source: SetupPoker.exe, 00000000.00000003.1190103747.00000000050F6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1258601555.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1300859702.0000000004B29000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1626296392.0000000005F64000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1402614507.00000000050CB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.00000000060A1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360679068.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1218193113.00000000051C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1
Source: SetupPoker.exe, 00000000.00000003.1224191324.000000000ADD4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043E9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.0000000006183000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1167158636.00000000061BB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1165848039.0000000006210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1245174803.0000000006717000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1392875491.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.000000000624E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1264527458.0000000006183000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1701611389.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1255503353.00000000063F6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1213792050.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.00000000066F8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000005FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1)
Source: SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1362088292.0000000005049000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1331356923.00000000051AC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1198655475.00000000062CE000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1299279940.00000000043F3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043E9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1C7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1542694460.0000000004F0F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1296337097.000000000632F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.000000000611E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1215276416.0000000005FB9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1572384432.000000000B143000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1453896201.0000000006373000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1299279940.0000000004407000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1346696740.00000000065BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1350633613.000000000638D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1291770213.0000000005202000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1447884721.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1.
Source: SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=15
Source: SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1195088513.0000000006064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1a
Source: SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1518487884.00000000050B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1c
Source: SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1298889123.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1ct
Source: SetupPoker.exe, 00000000.00000003.1190103747.000000000509D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1le=
Source: SetupPoker.exe, 00000000.00000003.1703524762.000000000509F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1nd
Source: SetupPoker.exe, 00000000.00000003.1481734742.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8lay
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SetupPoker.exe, 00000000.00000003.1622962938.0000000005124000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360608826.0000000005122000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251015133.0000000005123000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1518487884.000000000511B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1540007881.0000000005125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainp
Source: SetupPoker.exe, 00000000.00000003.1213792050.000000000611A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage
Source: SetupPoker.exe, 00000000.00000003.1269594656.0000000006064000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp
Source: SetupPoker.exe, 00000000.00000003.1297649621.00000000060C9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1295185122.000000000626F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360
Source: SetupPoker.exe, 00000000.00000003.1213792050.000000000611A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sct
Source: SetupPoker.exe, 00000000.00000003.1700759347.00000000051E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&p
Source: SetupPoker.exe, 00000000.00000003.1698105535.000000000510C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=
Source: SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1390999242.00000000051C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1392532156.00000000066A2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1466796455.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1292095846.000000000602B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1742950222.00000000060A3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.0000000006228000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1698105535.00000000050EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1
Source: SetupPoker.exe, 00000000.00000003.1481734742.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid
Source: SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1
Source: SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1(
Source: SetupPoker.exe, 00000000.00000003.1402614507.00000000050CB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.00000000060A1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1496683638.000000000612D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360679068.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1339229270.000000000619C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1609163367.0000000004C04000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1349563072.0000000005FBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1.
Source: SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.000000000611E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217835040.0000000004455000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1212669059.00000000061C1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1165452459.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.000000000611E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1252849268.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1297649621.00000000060C9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1260325059.00000000061C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1365625267.000000000611D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1392875491.0000000006129000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1405857455.0000000004458000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1621156221.000000000635D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1543908829.000000000635C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360232511.00000000060E5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.00000000061A8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1196691826.0000000004455000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.00000000066F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1.9.6
Source: SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1298889123.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1:
Source: SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1C
Source: SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1I
Source: SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1JQ
Source: SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1458910649.000000000510E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1RZ
Source: SetupPoker.exe, 00000000.00000003.1521972869.000000000618C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1RZU
Source: SetupPoker.exe, 00000000.00000003.1213151253.00000000050AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1ct
Source: SetupPoker.exe, 00000000.00000003.1213151253.00000000050AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1le=
Source: SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1ll4
Source: SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1nd
Source: SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1qP:
Source: SetupPoker.exe, 00000000.00000003.1190103747.000000000509D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1t
Source: SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1298889123.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1te
Source: SetupPoker.exe, 00000000.00000003.1190103747.000000000509D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1vaT
Source: SetupPoker.exe, 00000000.00000003.1532149058.0000000006297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1?
Source: SetupPoker.exe, 00000000.00000003.1521972869.00000000060C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1294123197.00000000061AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1D
Source: SetupPoker.exe, 00000000.00000003.1392875491.000000000618C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1HAVE
Source: SetupPoker.exe, 00000000.00000003.1165848039.0000000006210000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1N9
Source: SetupPoker.exe, 00000000.00000003.1611593972.00000000063F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1nachetAttribL0.ui
Source: SetupPoker.exe, 00000000.00000003.1698105535.00000000050EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4.
Source: SetupPoker.exe, 00000000.00000003.1405857455.0000000004460000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1480957110.0000000004462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360):n===
Source: SetupPoker.exe, 00000000.00000003.1409970289.0000000006084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360ohW
Source: SetupPoker.exe, 00000000.00000003.1521972869.0000000006104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360t
Source: SetupPoker.exe, 00000000.00000003.1215276416.0000000005FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.bet365.com/home/mainpage.asp?popmembers=5360ui-datepicker-group
Source: SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000440B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1572384432.000000000B0FF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueryui.com
Source: SetupPoker.exe, 00000000.00000003.1288634453.000000000AAD6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512277805.0000000004214000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1163768777.00000000041A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://localhost/playtech-assests/playtech_notifications/brands/config.brandFolder
Source: SetupPoker.exe, 00000000.00000003.1288634453.000000000AAD6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512277805.0000000004214000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1163768777.00000000041A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://localhost/playtech-assests/playtech_with_zips/brands/config.brandFolder
Source: SetupPoker.exe, 00000000.00000000.1128251483.000000000021E000.00000002.00000001.01000000.00000003.sdmp, SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://log.web-installer-assets.com/installer_logs
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: SetupPoker.exe, 00000000.00000003.1203683038.0000000006420000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://poker.bet365.com/home/en/
Source: SetupPoker.exe, 00000000.00000003.1532812270.00000000061D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://poker.bet365.com/home/en/W
Source: SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1269670994.0000000006426000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1538413353.0000000005201000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1295185122.000000000626F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://poker.bet365.com/home/en/n0
Source: SetupPoker.exe, 00000000.00000003.1455550723.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stats.ptinstaller.com/sta
Source: SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1734471646.000000000B367000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1387555004.0000000004210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1673754849.000000000AADB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.000000000503C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512911017.000000000AADA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stats.ptinstaller.com/stats.gif
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stats.ptinstaller.com/stats.gif?event=100&brand=Poker
Source: SetupPoker.exe, 00000000.00000003.1614315789.00000000060CF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1196561269.0000000005FAA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1446454182.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1483430393.000000000B0E2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1347089871.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1442450512.00000000060C8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1700759347.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1540127876.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1626296392.0000000005F64000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1218193113.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90
Source: SetupPoker.exe, 00000000.00000003.1576248421.00000000065AB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stats.ptinstaller.com/stats.gif?v=2&data=zxzlbnq9mtawjmjyyw5kpvbva2vyigf0iejlddm2nszldmvudf90
Source: SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com
Source: SetupPoker.exe, 00000000.00000003.1471854227.0000000005FFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1490559578.0000000006000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com#
Source: SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com)
Source: SetupPoker.exe, 00000000.00000003.1609163367.0000000004C04000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com.
Source: SetupPoker.exe, 00000000.00000003.1251559739.00000000060C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com1
Source: SetupPoker.exe, 00000000.00000003.1471854227.0000000005FFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1490559578.0000000006000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com3
Source: SetupPoker.exe, 00000000.00000003.1642502208.0000000004386000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1408519751.0000000004385000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.0000000004385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com7
Source: SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com9
Source: SetupPoker.exe, 00000000.00000003.1442450512.00000000060FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com:
Source: SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1345242474.00000000062EE000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1331356923.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1362088292.0000000005049000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1480200025.0000000005198000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1699540762.0000000005201000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043E9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1340457919.0000000005F5D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1542694460.0000000004F0F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1199918159.00000000060BC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1199619061.0000000006122000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1471129585.000000000520D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.000000000619E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1572384432.000000000B143000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1453896201.0000000006373000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1252849268.00000000043BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com;
Source: SetupPoker.exe, 00000000.00000003.1215276416.000000000602C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com?h
Source: SetupPoker.exe, 00000000.00000003.1408519751.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353797317.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comB
Source: SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251559739.00000000060C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comQ
Source: SetupPoker.exe, 00000000.00000003.1442450512.00000000060FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comR
Source: SetupPoker.exe, 00000000.00000003.1199275844.0000000005F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comT:
Source: SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comX
Source: SetupPoker.exe, 00000000.00000003.1215276416.000000000602C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.com_h
Source: SetupPoker.exe, 00000000.00000003.1335493226.0000000006257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comal
Source: SetupPoker.exe, 00000000.00000003.1408519751.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353797317.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comlo
Source: SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1269670994.0000000006426000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1538413353.0000000005201000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1295185122.000000000626F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comn0
Source: SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comq
Source: SetupPoker.exe, 00000000.00000003.1408519751.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353797317.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.comv
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SetupPoker.exe, 00000000.00000003.1455550723.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/
Source: SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1286318811.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/cabs/poker_bet365_com/
Source: SetupPoker.exe, 00000000.00000003.1576248421.00000000065AB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1610049126.00000000065AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/index.7z
Source: SetupPoker.exe, 00000000.00000003.1161764203.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/index.7zo/
Source: SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/
Source: SetupPoker.exe, 00000000.00000003.1729222927.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/D
Source: SetupPoker.exe, 00000000.00000003.1610049126.00000000065B9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1365625267.000000000611D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1266908713.00000000061A9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1602535050.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1392532156.00000000066A2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1617470375.0000000006025000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1276362442.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1354899913.0000000005FB1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1565113121.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1299279940.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1263345758.00000000062A7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1616377803.00000000066B7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1335299858.0000000005FA6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1265925218.00000000066B7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353927748.00000000061A4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1237390627.0000000005E03000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1183829160.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1213792050.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.00000000061A8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1659074011.0000000009A26000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7z
Source: SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1479485767.00000000043BB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1642245601.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7zC
Source: SetupPoker.exe, 00000000.00000003.1265237703.0000000006230000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.000000000622E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1335493226.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1745496128.0000000006236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7zl
Source: SetupPoker.exe, 00000000.00000003.1745496128.0000000006236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7zu
Source: SetupPoker.exe, 00000000.00000003.1265237703.0000000006230000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.000000000622E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7z~
Source: SetupPoker.exe, 00000000.00000003.1700759347.00000000051C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3a6p9a3vksur7.cloudfrontw
Source: SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1734471646.000000000B367000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000000.1128251483.000000000021E000.00000002.00000001.01000000.00000003.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1387555004.0000000004210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1673754849.000000000AADB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.000000000503C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512911017.000000000AADA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl-com.p365play.com/download/poker/client_update_urls.php
Source: SetupPoker.exe, 00000000.00000003.1599443576.00000000051C8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1463944166.00000000060C7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1576248421.000000000658F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1462128666.0000000004C0C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1340908766.00000000065F4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1492834099.00000000066F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251559739.00000000060C4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1194844392.0000000005FC8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1246215557.00000000065DD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1612066844.000000000672B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1609163367.0000000004C0F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1254269839.0000000004399000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.0000000004391000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1269321873.00000000065F4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1290970800.00000000065BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1732076953.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1215276416.0000000005FB9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.00000000043CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jquery-ui
Source: SetupPoker.exe, 00000000.00000003.1361142880.00000000062D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: SetupPoker.exe, 00000000.00000003.1521972869.0000000006111000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: SetupPoker.exe, 00000000.00000003.1462486583.000000000633B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1340279904.000000000633F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1479726702.0000000006344000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2m
Source: SetupPoker.exe, 00000000.00000003.1392875491.000000000618C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1201822631.00000000061A4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1486934205.00000000061A9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1266908713.00000000061A9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353927748.00000000061A4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1213792050.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.00000000061A8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1260626458.00000000061A3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1294123197.0000000006190000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1493512647.00000000061A9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1339229270.000000000619C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: SetupPoker.exe, 00000000.00000003.1191930955.0000000006301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfC:
Source: SetupPoker.exe, 00000000.00000003.1462486583.000000000633B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360389090.000000000633C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1270430219.000000000633B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1640862235.000000000633B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1480720293.000000000633B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1345242474.000000000633B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.85.39.184:443 -> 192.168.2.16:49833 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (12).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (13).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (14).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (15).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (16).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (17).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (18).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (19).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (20).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (21).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (22).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (23).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (24).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (25).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (26).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\index[1].7z entropy: 7.9994060033	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.7z entropy: 7.9994060033	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\index[1].7z entropy: 7.9994060033	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new.7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (27).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (28).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (29).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (30).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (31).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (32).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (33).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (34).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\new[1].7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (35).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (1).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (36).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\index[1].7z entropy: 7.9994060033	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (37).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (38).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (39).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (40).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (2).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (41).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\new[1].7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (42).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (3).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (43).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (4).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (44).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (5).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (6).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (7).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (8).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (9).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (10).7z entropy: 7.99335034694	Jump to dropped file
Source: C:\Users\user\Desktop\SetupPoker.exe	File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (11).7z entropy: 7.99335034694	Jump to dropped file

Source: SetupPoker.exe, 00000000.00000000.1128251483.000000000021E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinstaller.exe@ vs SetupPoker.exe
Source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameinstaller.exe@ vs SetupPoker.exe

Source: SetupPoker.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus39.rans.winEXE@1/70@2/2

Source: C:\Users\user\Desktop\SetupPoker.exe

File created: C:\Program Files (x86)\tempo_41

Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\stats[1].gif

Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe

File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\

Jump to behavior

Source: SetupPoker.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SetupPoker.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SetupPoker.exe

Virustotal: Detection: 7%

Source: C:\Users\user\Desktop\SetupPoker.exe

File read: C:\Users\user\Desktop\SetupPoker.exe

Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Section loaded: uiautomationcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SetupPoker.exe

Static PE information: certificate valid

Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SetupPoker.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SetupPoker.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SetupPoker.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\repo\web-installer-new\WebInstaller\Release\WebInstaller.pdb source: SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp

Source: SetupPoker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SetupPoker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SetupPoker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SetupPoker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SetupPoker.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SetupPoker.exe

File created: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\WebInstaller_7012.log

Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 4800000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 4E10000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5390000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 53B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 4300000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 53D0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5800000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5A50000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5C30000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5CD0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5D70000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5DB0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5E30000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5EB0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5920000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5940000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5980000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 59E0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5ED0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5EF0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5F10000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5F30000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 53F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 6750000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5410000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 9950000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 9970000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 9990000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 99B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5B70000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5BF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 54C0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A6A0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A6C0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A6E0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A700000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A720000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A7C0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A7F0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: ACA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5520000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A7C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A810000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A7C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A950000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A640000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A740000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5B20000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: 5A50000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A740000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\SetupPoker.exe	Memory allocated: A980000 memory commit \| memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.html	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: SetupPoker.exe, 00000000.00000003.1455550723.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SetupPoker.exe, 00000000.00000003.1455550723.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWndow Class

Source: C:\Users\user\Desktop\SetupPoker.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SetupPoker.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupPoker.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SetupPoker.exe

Directory queried: number of queries: 1001

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SetupPoker.exe	4%	ReversingLabs
SetupPoker.exe	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
stats.ptinstaller.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyODkzNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04NA%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMDQ5NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Ng%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NTU1NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTE%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMzIyOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02OQ%3D%3D	0%	Avira URL Cloud	safe
http://www.bet365.comB	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMjA1OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OA%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU0ODc2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00	0%	Avira URL Cloud	safe
http://www.bet365.comX	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NDU2NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDA%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?event=100&brand=Poker	0%	Avira URL Cloud	safe
http://www.bet365.comR	0%	Avira URL Cloud	safe
http://www.bet365.comQ	0%	Avira URL Cloud	safe
http://www.bet365.comal	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0OTI5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDU%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?event=100&brand=Poker	0%	Virustotal		Browse
http://stats.ptinstaller.com/stats.gif	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMTE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Nw%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMzYwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OQ%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNDIyMiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MA%3D%3D	0%	Avira URL Cloud	safe
http://www.bet365.comv	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMjY0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03OA%3D%3D	0%	Avira URL Cloud	safe
HTTP://HELP.BET	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MjQwNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDg%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif	0%	Virustotal		Browse
HTTP://HELP.BET	0%	Virustotal		Browse
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxOTUwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03NQ%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MDg1NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDY%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2OTc0NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjU%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzOTg2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NQ%3D%3D	0%	Avira URL Cloud	safe
https://d3a6p9a3vksur7.cloudfrontw	0%	Avira URL Cloud	safe
http://www.bet365.com_h	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNjM3OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mg%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MzAwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05OA%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNTc5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MQ%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MDI5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTY%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2ODE4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjQ%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU1MzkxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU2MjYxNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xOA%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwNjY0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Mg%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MTg4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTc%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/sta	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU4Njg0OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00Mg%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1Mzk4NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDk%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NjU1MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjI%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNzk0MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mw%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU3MzE2MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0yOQ%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MzQ0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTk%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NTAwOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjA%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNDgzMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03MA%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMTA4NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Nw%3D%3D	0%	Avira URL Cloud	safe
http://stats.ptinstaller.com/sta	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
stats.ptinstaller.com	52.213.137.28	true	false	0%, Virustotal, Browse	unknown
d3a6p9a3vksur7.cloudfront.net	52.85.39.184	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMzIyOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02OQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyODkzNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04NA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMDQ5NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Ng%3D%3D	false	Avira URL Cloud: safe	unknown
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/index.7z	false		high
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NTU1NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTE%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU0ODc2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMjA1OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NDU2NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDA%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0OTI5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDU%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMTE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Nw%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMzYwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNDIyMiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMjY0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03OA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MjQwNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDg%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MDg1NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDY%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxOTUwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03NQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2OTc0NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjU%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzOTg2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNjM3OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mg%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MzAwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05OA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNTc5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MDI5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTY%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2ODE4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjQ%3D	false	Avira URL Cloud: safe	unknown
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7z	false		high
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU1MzkxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU2MjYxNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xOA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwNjY0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Mg%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MTg4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTc%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU4Njg0OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00Mg%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1Mzk4NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDk%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NjU1MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjI%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNzk0MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mw%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MzQ0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTk%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU3MzE2MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0yOQ%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NTAwOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjA%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNDgzMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03MA%3D%3D	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMTA4NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Nw%3D%3D	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://help.bet365.com/home/mainpage.asp?popmembers=5360t	SetupPoker.exe, 00000000.00000003.1521972869.0000000006104000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/	SetupPoker.exe, 00000000.00000003.1576248421.00000000065AB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1610049126.00000000065AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bet365.comB	SetupPoker.exe, 00000000.00000003.1408519751.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353797317.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8lay	SetupPoker.exe, 00000000.00000003.1481734742.0000000000AB4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfront.net/cabs/poker_bet365_com/	SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1286318811.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://jqueryui.com	SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000440B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1572384432.000000000B0FF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1qP:	SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bet365.comX	SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.bet365.com/home/mainpage.asp?popmembers=5360ui-datepicker-group	SetupPoker.exe, 00000000.00000003.1215276416.0000000005FC1000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1c	SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1518487884.00000000050B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://stats.ptinstaller.com/stats.gif?event=100&brand=Poker	SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1a	SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1195088513.0000000006064000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1RZU	SetupPoker.exe, 00000000.00000003.1521972869.000000000618C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bet365.comR	SetupPoker.exe, 00000000.00000003.1442450512.00000000060FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bet365.comQ	SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251559739.00000000060C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bet365.comal	SetupPoker.exe, 00000000.00000003.1335493226.0000000006257000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stats.ptinstaller.com/stats.gif	SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1734471646.000000000B367000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1387555004.0000000004210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1673754849.000000000AADB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.000000000503C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512911017.000000000AADA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1ct	SetupPoker.exe, 00000000.00000003.1213151253.00000000050AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1te	SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1298889123.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfront.net/	SetupPoker.exe, 00000000.00000003.1455550723.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=15	SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl-com.p365play.com/download/poker/client_update_urls.php	SetupPoker.exe, 00000000.00000003.1247345609.000000000B0D7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1734471646.000000000B367000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1242698688.000000000B12F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1588994617.000000000650F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000000.1128251483.000000000021E000.00000002.00000001.01000000.00000003.sdmp, SetupPoker.exe, 00000000.00000003.1327375458.000000000B168000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1222273109.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1387555004.0000000004210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1673754849.000000000AADB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.000000000503C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1433754664.000000000B1E3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1512911017.000000000AADA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1162797752.00000000054A5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1648619192.0000000005021000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1678150128.000000000AAFD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1210337444.0000000004203000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1.	SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1362088292.0000000005049000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1331356923.00000000051AC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1198655475.00000000062CE000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1299279940.00000000043F3000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043E9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1735725553.000000000B1C7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1542694460.0000000004F0F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1296337097.000000000632F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.000000000611E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1215276416.0000000005FB9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1572384432.000000000B143000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1453896201.0000000006373000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1299279940.0000000004407000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1346696740.00000000065BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1350633613.000000000638D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1291770213.0000000005202000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1447884721.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1HAVE	SetupPoker.exe, 00000000.00000003.1392875491.000000000618C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4.	SetupPoker.exe, 00000000.00000003.1698105535.00000000050EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bet365.comv	SetupPoker.exe, 00000000.00000003.1408519751.00000000043B5000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1341594024.00000000043B1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1353797317.00000000043BA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bet365.comq	SetupPoker.exe, 00000000.00000003.1734189784.0000000006581000.00000004.00000020.00020000.00000000.sdmp	false		unknown
HTTP://HELP.BET	SetupPoker.exe, 00000000.00000003.1406630300.0000000004F24000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid	SetupPoker.exe, 00000000.00000003.1481734742.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360	SetupPoker.exe, 00000000.00000003.1297649621.00000000060C9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1295185122.000000000626F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&p	SetupPoker.exe, 00000000.00000003.1700759347.00000000051E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://stats.ptinstaller.com/stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90	SetupPoker.exe, 00000000.00000003.1614315789.00000000060CF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1196561269.0000000005FAA000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1446454182.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1483430393.000000000B0E2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1347089871.00000000060BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1442450512.00000000060C8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1700759347.00000000051C9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1540127876.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1626296392.0000000005F64000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1218193113.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1D	SetupPoker.exe, 00000000.00000003.1521972869.00000000060C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1294123197.00000000061AF000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1	SetupPoker.exe, 00000000.00000003.1190103747.00000000050F6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1258601555.0000000006064000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1300859702.0000000004B29000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1626296392.0000000005F64000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1402614507.00000000050CB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.00000000060A1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360679068.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1218193113.00000000051C6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1le=	SetupPoker.exe, 00000000.00000003.1213151253.00000000050AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/D	SetupPoker.exe, 00000000.00000003.1729222927.0000000005AB7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1?	SetupPoker.exe, 00000000.00000003.1532149058.0000000006297000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1)	SetupPoker.exe, 00000000.00000003.1224191324.000000000ADD4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1595144997.00000000043E9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.0000000006183000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1167158636.00000000061BB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1165848039.0000000006210000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1245174803.0000000006717000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1392875491.00000000060D8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1532812270.000000000624E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1264527458.0000000006183000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1701611389.00000000043DC000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1255503353.00000000063F6000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1213792050.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.00000000066F8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000005FE7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfrontw	SetupPoker.exe, 00000000.00000003.1700759347.00000000051C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bet365.com_h	SetupPoker.exe, 00000000.00000003.1215276416.000000000602C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1le=	SetupPoker.exe, 00000000.00000003.1190103747.000000000509D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://poker.bet365.com/home/en/n0	SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1269670994.0000000006426000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1217463206.0000000005203000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1538413353.0000000005201000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1295185122.000000000626F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1193702752.0000000006174000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1vaT	SetupPoker.exe, 00000000.00000003.1190103747.000000000509D000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4&LNG=1&TID=1nd	SetupPoker.exe, 00000000.00000003.1703524762.000000000509F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/index.7zo/	SetupPoker.exe, 00000000.00000003.1161764203.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sct	SetupPoker.exe, 00000000.00000003.1213792050.000000000611A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1JQ	SetupPoker.exe, 00000000.00000003.1166265797.0000000005FBB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1190979187.0000000006108000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1RZ	SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1458910649.000000000510E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bet365.com?h	SetupPoker.exe, 00000000.00000003.1215276416.000000000602C000.00000004.00000020.00020000.00000000.sdmp	false		high
HTTP://HELP.BET365.COM/HOME/MAINPAGE.ASP?POPMEMBERS=5360&SCTID=8&PRD=4	SetupPoker.exe, 00000000.00000003.1191930955.000000000638D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.00000000061D1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1161782322.000000000447E000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1333495568.0000000006084000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1442450512.0000000006150000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1268648812.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006099000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.0000000006156000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1521972869.0000000006148000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1241553559.000000000AF28000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1271712315.000000000A932000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1335493226.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1248039607.000000000621C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1268165536.00000000061D2000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1216617589.0000000006391000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1683864054.000000000614D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1:	SetupPoker.exe, 00000000.00000003.1337919156.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1298889123.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348554532.00000000050C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1.	SetupPoker.exe, 00000000.00000003.1402614507.00000000050CB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1578571682.00000000060A1000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1496683638.000000000612D000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360679068.00000000050CD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1339229270.000000000619C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1609163367.0000000004C04000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1349563072.0000000005FBC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jquery/jquery-ui	SetupPoker.exe, 00000000.00000003.1599443576.00000000051C8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1463944166.00000000060C7000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1576248421.000000000658F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1462128666.0000000004C0C000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1340908766.00000000065F4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1492834099.00000000066F0000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251559739.00000000060C4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1194844392.0000000005FC8000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1328744745.000000000B091000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1246215557.00000000065DD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1612066844.000000000672B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1609163367.0000000004C0F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1254269839.0000000004399000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1440184255.00000000066B4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1450574053.0000000004391000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1329971338.000000000669F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1269321873.00000000065F4000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1290970800.00000000065BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1732076953.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1215276416.0000000005FB9000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1740534383.00000000043CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://stats.ptinstaller.com/sta	SetupPoker.exe, 00000000.00000003.1455550723.0000000000A3A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1I	SetupPoker.exe, 00000000.00000003.1477096688.00000000050BF000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	false		high
http://stats.ptinstaller.com/stats.gif?v=2&data=zxzlbnq9mtawjmjyyw5kpvbva2vyigf0iejlddm2nszldmvudf90	SetupPoker.exe, 00000000.00000003.1576248421.00000000065AB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1407302354.0000000005099000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://d3a6p9a3vksur7.cloudfront.net/compressed_assets/poker_bet365_com/templates/installer/new.7zC	SetupPoker.exe, 00000000.00000003.1450574053.00000000043BD000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1479485767.00000000043BB000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1642245601.00000000043BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1C	SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainp	SetupPoker.exe, 00000000.00000003.1622962938.0000000005124000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1360608826.0000000005122000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1251015133.0000000005123000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1518487884.000000000511B000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1540007881.0000000005125000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1&tid=1(	SetupPoker.exe, 00000000.00000003.1337919156.000000000510F000.00000004.00000020.00020000.00000000.sdmp, SetupPoker.exe, 00000000.00000003.1348043288.000000000510A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1nachetAttribL0.ui	SetupPoker.exe, 00000000.00000003.1611593972.00000000063F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://poker.bet365.com/home/en/W	SetupPoker.exe, 00000000.00000003.1532812270.00000000061D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.bet365.com/home/mainpage.asp?popmembers=5360&sctid=8&prd=4&lng=1N9	SetupPoker.exe, 00000000.00000003.1165848039.0000000006210000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.213.137.28	stats.ptinstaller.com	United States		16509	AMAZON-02US	false
52.85.39.184	d3a6p9a3vksur7.cloudfront.net	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431066
Start date and time:	2024-04-24 14:31:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SetupPoker.exe
Detection:	SUS
Classification:	sus39.rans.winEXE@1/70@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SetupPoker.exe, PID 7012 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:31:41	API Interceptor	94x Sleep call for process: SetupPoker.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.213.137.28	SecuriteInfo.com.Unwanted-Program.0056626f1.14175.11685.exe	Get hash	malicious	Unknown	Browse
52.213.137.28	RqJSPKzbZN.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
stats.ptinstaller.com	SecuriteInfo.com.Unwanted-Program.0056626f1.14175.11685.exe	Get hash	malicious	Unknown	Browse	52.213.137.28
d3a6p9a3vksur7.cloudfront.net	SecuriteInfo.com.Unwanted-Program.0056626f1.14175.11685.exe	Get hash	malicious	Unknown	Browse	18.67.66.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	108.139.10.63
	http://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	108.139.10.63
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	18.155.192.11
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	44.236.24.209
	https://postnoord.dk.yiff.fi/sunia/u/r/	Get hash	malicious	Unknown	Browse	3.163.125.24
	65kw6IfQdO.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	18.154.132.124
	i6MGE0UeYG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	http://d1isumqvmnq7jz.cloudfront.net/build/pl/v4.397.63.30.34	Get hash	malicious	Unknown	Browse	108.139.9.151
	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
AMAZON-02US	https://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	108.139.10.63
	http://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	108.139.10.63
	https://i.imgur.com/EoTj4iI.png	Get hash	malicious	Unknown	Browse	18.155.192.11
	https://i.imgur.com/VlAllek.png	Get hash	malicious	Unknown	Browse	44.236.24.209
	https://postnoord.dk.yiff.fi/sunia/u/r/	Get hash	malicious	Unknown	Browse	3.163.125.24
	65kw6IfQdO.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	18.154.132.124
	i6MGE0UeYG.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	http://d1isumqvmnq7jz.cloudfront.net/build/pl/v4.397.63.30.34	Get hash	malicious	Unknown	Browse	108.139.9.151
	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	107. PN-EN-1090-2+A1_2012P.exe	Get hash	malicious	GuLoader, Remcos	Browse	52.85.39.184
	BM-FM_NR.24040718PDF.exe	Get hash	malicious	FormBook, GuLoader	Browse	52.85.39.184
	Z4CYGTBlj7.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	52.85.39.184
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	52.85.39.184
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	52.85.39.184
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	52.85.39.184
	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	52.85.39.184
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	52.85.39.184
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	52.85.39.184
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	52.85.39.184

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	325970
Entropy (8bit):	7.999406003296915
Encrypted:	true
SSDEEP:	6144:YlEs7CsO50ZCm6tDCrRbfHtNXieHUOuiB2BZEU14QQOX0pVlGnn:aEs7CsE+Kkbf7XnCiwnBQOEfo
MD5:	DABF9EF79326A6B036BD65B39A7FFAB3
SHA1:	34263EFFE77326680C72C0D7F895EE3501D2BBA8
SHA-256:	7408991BB8EBD41D2484BD5359A78B87DA59D33F6FD40F57D083286E92CD1708
SHA-512:	EDA23C757ACE19A0543C8E2B0406FFFE3DC09B3DAEFCFC119E85C380BEA83212B24E5300BD7370890A45D7FCEB1F1A780D697ADAC7D1DA2BA35C76BAC72B9B6D
Malicious:	true
Reputation:	low
Preview:	7z..'.....Q!.................B..\| .1W..^...p@....o...a...C.L\|.XRX.+..).. W3....y.Ai`..Vl......R".n...".tl/...Dw..w..6....o]..7...S.t.9H4.2>N.....u.......;.>...+.W..y..ip.......m.Q.1.{...f......L..G3)....)^k..fm.rj.>s..q.p.h..#......^.HB.{...k...].....Iu}.......,8.7..W)3].w......./.{.^9.....W...v.\.Q.?...Ox.\...=H...."c....u.(.v~....\|_.........A.B.$..;.q..!.v.x....+i.......V........l.G..w.............X.O..4..\|...{.}......y..\|N...y...>.'..".Ek...V..8,!.A..L.o.... ..;..xo.6.. ..X.-/.}qZ...5....+.Z....\|.\|.u.....T6..le.....2.[.rY..T....v.<4.....!%>_>."4.`.4.D... .,jaA.J.O..y..'.)..=.Ol.N.sp.i.a<Q..`...k.k..6.;....Og..9^c..XX..;.a....x..+..K...%..Kl{f.gY....H..-nz0.^..._V......\?Y..eA.c....x...$.........sn...:.I.x^..j7......y.j..{....N....f.}..........N.Cd.9..S.%...ea...<.(..s..p....~.$>...k..=?...lN.b....R....^].....+...N.....-.@)..6.[.....F._....~.1.v4..=w.CU...$(...t.*..4]#..p?O..5....0z.1.Wts..o./..i...xr.U..N0..._..d{rn.Rk.b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\new[1].7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	7.980952751662445
Encrypted:	false
SSDEEP:	192:kVYhTSsVu+FJT9czIGHNgw1yF4uodyT13ljRDwFodecg/qNynMf:yATSsVueTezIGHNfyKuZ3dDRKqQMf
MD5:	ED0AB3199E0882A22F667E75E2A29688
SHA1:	8397E407C835878C9A38BEC3BBE23788221F5508
SHA-256:	7BFE49D9FDC4BA0253D329306F2A5B0F324F7E93EDA917817E4124612CE65464
SHA-512:	CD9DC84BCE1EF6EC9CCAB660F8CCA331BBD421455016BD684D6C43F8FFE1BC099EDA6B2C18058C42564F8FA6E4CDDABF4AA3FFDE3191A823F6512D5EA950A1E4
Malicious:	false
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\index[1].7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	325970
Entropy (8bit):	7.999406003296915
Encrypted:	true
SSDEEP:	6144:YlEs7CsO50ZCm6tDCrRbfHtNXieHUOuiB2BZEU14QQOX0pVlGnn:aEs7CsE+Kkbf7XnCiwnBQOEfo
MD5:	DABF9EF79326A6B036BD65B39A7FFAB3
SHA1:	34263EFFE77326680C72C0D7F895EE3501D2BBA8
SHA-256:	7408991BB8EBD41D2484BD5359A78B87DA59D33F6FD40F57D083286E92CD1708
SHA-512:	EDA23C757ACE19A0543C8E2B0406FFFE3DC09B3DAEFCFC119E85C380BEA83212B24E5300BD7370890A45D7FCEB1F1A780D697ADAC7D1DA2BA35C76BAC72B9B6D
Malicious:	true
Reputation:	low
Preview:	7z..'.....Q!.................B..\| .1W..^...p@....o...a...C.L\|.XRX.+..).. W3....y.Ai`..Vl......R".n...".tl/...Dw..w..6....o]..7...S.t.9H4.2>N.....u.......;.>...+.W..y..ip.......m.Q.1.{...f......L..G3)....)^k..fm.rj.>s..q.p.h..#......^.HB.{...k...].....Iu}.......,8.7..W)3].w......./.{.^9.....W...v.\.Q.?...Ox.\...=H...."c....u.(.v~....\|_.........A.B.$..;.q..!.v.x....+i.......V........l.G..w.............X.O..4..\|...{.}......y..\|N...y...>.'..".Ek...V..8,!.A..L.o.... ..;..xo.6.. ..X.-/.}qZ...5....+.Z....\|.\|.u.....T6..le.....2.[.rY..T....v.<4.....!%>_>."4.`.4.D... .,jaA.J.O..y..'.)..=.Ol.N.sp.i.a<Q..`...k.k..6.;....Og..9^c..XX..;.a....x..+..K...%..Kl{f.gY....H..-nz0.^..._V......\?Y..eA.c....x...$.........sn...:.I.x^..j7......y.j..{....N....f.}..........N.Cd.9..S.%...ea...<.(..s..p....~.$>...k..=?...lN.b....R....^].....+...N.....-.@)..6.[.....F._....~.1.v4..=w.CU...$(...t.*..4]#..p?O..5....0z.1.Wts..o./..i...xr.U..N0..._..d{rn.Rk.b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\new[1].7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\index[1].7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	325970
Entropy (8bit):	7.999406003296915
Encrypted:	true
SSDEEP:	6144:YlEs7CsO50ZCm6tDCrRbfHtNXieHUOuiB2BZEU14QQOX0pVlGnn:aEs7CsE+Kkbf7XnCiwnBQOEfo
MD5:	DABF9EF79326A6B036BD65B39A7FFAB3
SHA1:	34263EFFE77326680C72C0D7F895EE3501D2BBA8
SHA-256:	7408991BB8EBD41D2484BD5359A78B87DA59D33F6FD40F57D083286E92CD1708
SHA-512:	EDA23C757ACE19A0543C8E2B0406FFFE3DC09B3DAEFCFC119E85C380BEA83212B24E5300BD7370890A45D7FCEB1F1A780D697ADAC7D1DA2BA35C76BAC72B9B6D
Malicious:	true
Reputation:	low
Preview:	7z..'.....Q!.................B..\| .1W..^...p@....o...a...C.L\|.XRX.+..).. W3....y.Ai`..Vl......R".n...".tl/...Dw..w..6....o]..7...S.t.9H4.2>N.....u.......;.>...+.W..y..ip.......m.Q.1.{...f......L..G3)....)^k..fm.rj.>s..q.p.h..#......^.HB.{...k...].....Iu}.......,8.7..W)3].w......./.{.^9.....W...v.\.Q.?...Ox.\...=H...."c....u.(.v~....\|_.........A.B.$..;.q..!.v.x....+i.......V........l.G..w.............X.O..4..\|...{.}......y..\|N...y...>.'..".Ek...V..8,!.A..L.o.... ..;..xo.6.. ..X.-/.}qZ...5....+.Z....\|.\|.u.....T6..le.....2.[.rY..T....v.<4.....!%>_>."4.`.4.D... .,jaA.J.O..y..'.)..=.Ol.N.sp.i.a<Q..`...k.k..6.;....Og..9^c..XX..;.a....x..+..K...%..Kl{f.gY....H..-nz0.^..._V......\?Y..eA.c....x...$.........sn...:.I.x^..j7......y.j..{....N....f.}..........N.Cd.9..S.%...ea...<.(..s..p....~.$>...k..=?...lN.b....R....^].....+...N.....-.@)..6.[.....F._....~.1.v4..=w.CU...$(...t.*..4]#..p?O..5....0z.1.Wts..o./..i...xr.U..N0..._..d{rn.Rk.b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\new[1].7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\WebInstaller_7012.log

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	429195
Entropy (8bit):	3.0063406592570083
Encrypted:	false
SSDEEP:	768:WhCMyXtAk8YazF0T4xOEfYWuvdoQl3PB4M1GVUCj22vAwCdErlUP4ykM5m9c7KOk:Mt3anwm7KwkHG/8LDJYl+H
MD5:	A688DE8C7115B8C1EBEC0DB0462E51C7
SHA1:	D7D1DA36628693DFC046EF20775B6AD865864068
SHA-256:	8222F56E64DA893AD265EC7133FF7BF11AA1612AF619A49D6040929CE2747499
SHA-512:	27DCE62D665F48D9911FCABC397ED6BC815BBFB1FC08E71D62F1CC56B9C3AF268C9D6C1CE8BF49A4C8223D205672C76C828F63BAA971D49CA5BA013840464D55
Malicious:	false
Reputation:	low
Preview:	.9BAB9FAB84AB99AB9FAB84AB99AB9FAB8BAB9AAB9FAB91AB98AB9AAB91AB9FAB9BAB8BAB83AB93AB93AB82AB8BABD7AB8BABDBABC2ABCFAB91AB8BAB9CAB9BAB9AAB99AB87AB8BABDFABC2ABCFAB91AB8BAB9CAB9BAB9AAB9DAB8BABD7AB8BABEAABFBABFBABE7ABE2ABE8ABEAABFFABE2ABE4ABE5AB8BABD7AB8BABEFABE9ABECAB8BABD7AB8BABE8ABEAABDBABDBABC7ABC2ABC8ABCAABDFABC2ABC4ABC5AB91AB91ABF9ABDEABC5AB8BABC7ABC4ABCAABCFAB8BABCFABCAABDFABCAAB8BABC2ABCFABF0AB98AB9CAB9DABF6AB8BABC9ABD9ABCAABC5ABCFABF0ABDBABC4ABC0ABCEABD9ABF4ABC9ABCEABDFAB98AB9DAB9EABF4ABC8ABC4ABC6ABF6ABA1AB9BAB9FAB84AB99AB9FAB84AB99AB9FAB8BAB9AAB9FAB91AB98AB9AAB91AB9FAB9BAB8BAB83AB9AAB99AB9DAB82AB8BABD7AB8BABDBABC2ABCFAB91AB8BAB9CAB9BAB9AAB99AB87AB8BABDFABC2ABCFAB91AB8BAB9CAB9BAB9AAB9DAB8BABD7AB8BABFEABFFABE2ABE7ABF8AB8BABD7AB8BABEFABE9ABECAB8BABD7AB8BABE8ABEDABC2ABC7ABCEABF8ABD2ABD8ABDFABCEABC6ABFEABDFABC2ABC7ABD8AB91AB91ABE8ABD9ABCEABCAABDFABCEABEFABC2ABD9ABCEABC8ABDFABC4ABD9ABD2ABF9ABCEABC8ABDEABD9ABC8ABC2ABDDABCEAB8BABE8ABD9ABCEABCAABDFABCEABCFAB8BABCFABC2ABD9ABCEABC8ABDFABC4ABD

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	325970
Entropy (8bit):	7.999406003296915
Encrypted:	true
SSDEEP:	6144:YlEs7CsO50ZCm6tDCrRbfHtNXieHUOuiB2BZEU14QQOX0pVlGnn:aEs7CsE+Kkbf7XnCiwnBQOEfo
MD5:	DABF9EF79326A6B036BD65B39A7FFAB3
SHA1:	34263EFFE77326680C72C0D7F895EE3501D2BBA8
SHA-256:	7408991BB8EBD41D2484BD5359A78B87DA59D33F6FD40F57D083286E92CD1708
SHA-512:	EDA23C757ACE19A0543C8E2B0406FFFE3DC09B3DAEFCFC119E85C380BEA83212B24E5300BD7370890A45D7FCEB1F1A780D697ADAC7D1DA2BA35C76BAC72B9B6D
Malicious:	true
Reputation:	low
Preview:	7z..'.....Q!.................B..\| .1W..^...p@....o...a...C.L\|.XRX.+..).. W3....y.Ai`..Vl......R".n...".tl/...Dw..w..6....o]..7...S.t.9H4.2>N.....u.......;.>...+.W..y..ip.......m.Q.1.{...f......L..G3)....)^k..fm.rj.>s..q.p.h..#......^.HB.{...k...].....Iu}.......,8.7..W)3].w......./.{.^9.....W...v.\.Q.?...Ox.\...=H...."c....u.(.v~....\|_.........A.B.$..;.q..!.v.x....+i.......V........l.G..w.............X.O..4..\|...{.}......y..\|N...y...>.'..".Ek...V..8,!.A..L.o.... ..;..xo.6.. ..X.-/.}qZ...5....+.Z....\|.\|.u.....T6..le.....2.[.rY..T....v.<4.....!%>_>."4.`.4.D... .,jaA.J.O..y..'.)..=.Ol.N.sp.i.a<Q..`...k.k..6.;....Og..9^c..XX..;.a....x..+..K...%..Kl{f.gY....H..-nz0.^..._V......\?Y..eA.c....x...$.........sn...:.I.x^..j7......y.j..{....N....f.}..........N.Cd.9..S.%...ea...<.(..s..p....~.$>...k..=?...lN.b....R....^].....+...N.....-.@)..6.[.....F._....~.1.v4..=w.CU...$(...t.*..4]#..p?O..5....0z.1.Wts..o./..i...xr.U..N0..._..d{rn.Rk.b

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.html

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	HTML document, ASCII text, with very long lines (33425)
Category:	dropped
Size (bytes):	1312672
Entropy (8bit):	6.290794022288506
Encrypted:	false
SSDEEP:	24576:A5TXHLcxbN0AgL6opP44h9q6tjDEeRXnza64k4oa6xAA9PApNzawFf51Lu7opnZP:A5TXHLcxbN0AgL6opP44h9ntjDXnf49V
MD5:	8D5F1450ACDFDB6EAB03E051DE9AE106
SHA1:	152ED1F01149CB5CEBE56EECF532B38E6A461306
SHA-256:	4422430193C8EF1EE26D2FB34B77DF046BB028B862418D7760B6F27F40038961
SHA-512:	8A7CBF7A239AA851DE65EDCB4D5DDAFDEC0C221BCF2195C6FA5FFDF1D553110998FB9B5DC1A9BA56E03416290ACD630569AD6598184F883F45F21FC9FE4E2546
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html>.<head>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<style type="text/css">..// === start css/jquery-ui.css === ../! jQuery UI - v1.8.24 - 2012-09-28. https://github.com/jquery/jquery-ui.* Includes: jquery.ui.core.css, jquery.ui.accordion.css, jquery.ui.autocomplete.css, jquery.ui.button.css, jquery.ui.datepicker.css, jquery.ui.dialog.css, jquery.ui.progressbar.css, jquery.ui.resizable.css, jquery.ui.selectable.css, jquery.ui.slider.css, jquery.ui.tabs.css, jquery.ui.theme.css.* Copyright (c) 2012 AUTHORS.txt; Licensed MIT, GPL */.ui-helper-hidden{display:none}.ui-helper-hidden-accessible{position:absolute !important;clip:rect(1px 1px 1px 1px);clip:rect(1px,1px,1px,1px)}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;li

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (1).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (10).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (11).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (12).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (13).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (14).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Reputation:	low
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (15).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (16).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (17).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (18).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (19).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (2).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (20).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (21).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (22).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (23).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (24).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (25).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (26).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (27).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (28).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (29).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (3).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (30).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (31).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (32).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (33).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (34).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (35).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (36).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (37).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (38).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (39).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (4).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (40).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (41).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (42).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (43).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (44).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (5).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (6).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (7).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (8).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (9).7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new.7z

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	29122
Entropy (8bit):	7.9933503469425204
Encrypted:	true
SSDEEP:	768:ybYezLHtXuPRTr7XqaP6MGs2XMUH8/aG9V8f:Pzlr7pis2cUc/VVK
MD5:	844817CA2E3C1E633F41EE03FFC052BB
SHA1:	6DDEC5F2444EDCE1D134350B77308E04B92853F2
SHA-256:	DE14E44DB9E8EE98359C52CD6DACC7DDD29B04927F8811DA769EBBFE37CFF3FB
SHA-512:	46F5E2099841C918A00B7C5C5C9FA54AA6FD8E72453F3A70F0EF659D9EBAF8120542D496E57DBD04668C994067D7E76C87B78FA95B0C98E1BFC8EEAFD9D9E9EB
Malicious:	true
Preview:	7z..'...X..m~q......$.......:.x...h...`....f.rh..O...nV..k.[..{@s.AV...[...J{.)......m..n[...:..Eu....`6F......).i..Q.J,.bk{>a.\|.Kb.Rb.....\|.qW..$..."/.$J....N.].>.B........FB.f..F......Dg.i....8)...t"...=...E..Z...$.......[.....!../1......b-gJ.J+.........T...a.-.M/.b......Tw...q..0..`<... .g-r'.qTH.....p.J.r..V....C:.>Z........a...L...Y8..QQ.6.v..&..7.a..%..T....Q.,.&.0..C..$-O...v...=.^..`s.UY.YqW.}....ZzYcV...J.H...{f..=".6.<D...`4pd.o.../[.2 %.R.ay..].n.I..6...u2.L$X..0....m..I.y.'}b,..w.....r...cM.Av.....<xl......J..}.\|k.i<..=.D$.a.g.Wo$...2....:....-.g.....f.>.C...0....4........-.v.(.2:.-.-.P.h..$.DN...ns....)56..Pf.......K...)....51..]..&..v....>.Kv...4.(x...`.......T.H.S..+n.A..uD"k...G..Q..W..../U......RA...L...uL.yt.{.IQx.=..!;\|..<.H....p.M....!.8.t.C.d,.(%............SMP{.....p........)....=....ya.=.r...e-S~...H.j.0;..!.A?J..%.t...L...g..$.w.A..m.gAu.[.S....zu.k..W..yd4[X.4..4}..4....:A"o>...l%..s .X.X...;..M..RXV.....\.W...3

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\css\template.css

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9355
Entropy (8bit):	5.071723751176114
Encrypted:	false
SSDEEP:	96:kPqvTnhLFBQj8Z1BmBY+MpNI2fhCqeAzMO66p8vlXjCXcQu2dIBFHYP/5oYC5PB6:kPqLRF6jMZpIWJu0KFHYHpg6
MD5:	755AB205A3814E608AD3A130A774838A
SHA1:	3A05403B0D36198E5303583CEA90B088ACBC8C77
SHA-256:	F13BB3AF1B377E0FE810304201CD06B859E416C219FE79424F7DEF3F637D31AA
SHA-512:	3E72FBD27CA1EF8F8B2125FAE09ACDEA2057F9D475A59F8E5B46FE4E0CCB9635DB90D7BA656FA2D2822AF58B7C7EC727A12C724F0AB4A6A952B8960B1433D31D
Malicious:	false
Preview:	* {. padding: 0;. margin: 0;.}..#slide1 {. display: block;.}..html {. overflow-x: hidden;. overflow-y: hidden;. -ms-user-select: none;. user-select: none;. cursor: default;.}..body {. -ms-user-select: none;. user-select: none;. font-family: Arial, sans-serif;. font-size: 12px;. color: #fff;.}.../.----------------------------. Common Styles.----------------------------./...main_wrapper {. position: relative;. background: url('{IMAGES_FOLDER}/background.jpg') no-repeat;. width: 887px;. height: 557px;.}....advantages_list li {. color: #fff;.}...flag {. position: absolute;. margin-top: 3px;. margin-left: -20px;. margin-top: 1px;. margin-left: -10px;. width: 18px;. height: 13px;.}...slides_mask {. position: relative;. width: 817px;. height: 514px;. margin-left: 35px;. overflow: hidden;.}...select_language {. position: absolute;. left: 267px;. top: 144px;. height: 31px;. z-index: 1

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\html\template.html

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8852
Entropy (8bit):	4.7155806382656476
Encrypted:	false
SSDEEP:	192:D7rD/IC3y62r767rp6NrL65rl65rI6Rrl6krB6hru6prb60rkJ6dru6vrR6prZ6c:D7rD/IC3y62r767rp6NrL65rl65rI6RF
MD5:	C523A444CD764B915A7B689213111187
SHA1:	43632FEE9B493C25DF48F01E54903D1E8B40B718
SHA-256:	86328F2B83CF3AEB5B2244F2775EBF476BEBC27E7D02E457BE3D1037FCD3F586
SHA-512:	3E82F6140019F8FA3E674B7E500B878A10D1464A30E47FC8BD9E7ACA6452D0AF8785B6DDCCE26F710E9614D2767E2750F6B9C2C74D3755058954ADCA7BC7903C
Malicious:	false
Preview:	<div class="main_wrapper">...<div class="close_button hook_x_button"></div>..<div class="casinologo" style="display: none;"></div>...<div class="slides_mask">...<div class="slides_holder">.... ----------------- START SLIDE 1 //-----------------//-->....<div id="slide1" data-screenlang="true" data-screeneula="true" data-screenorder="1">.....<div class="casinologo"></div>......<div class="advantages_list">......<ul>.......<li class="support">........<div></div>........<span class='text' data-transkey="countless_games">Countless <br/> cash games</span>.......</li>.......<li class="secure">........<div></div>........<span class='text' data-transkey="attractive_tournaments">Attractive <br/> tournaments</span>.......</li>.......<li class="virus_free">........<div></div>........<span class='text' data-transkey="thrilling_casino_games">Thrilling <br/> casino games</span>.......</li>......</ul>.....</div>......<span class="step_title" data-transkey="welcome_msg_title">......Welcome to {BRAN

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\attractive_tournaments_icon.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 52 x 52, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	567
Entropy (8bit):	7.3538729995231025
Encrypted:	false
SSDEEP:	12:6v/7n0l+nMztaqUgbRhTi9Iv8t56liKSGdgnq+CwQJNnyIOX/:E0iwafgdhuq85DG3+CwaC/
MD5:	70F7C3E4F9D8ABD8177CBF3DA17B78B7
SHA1:	0947365F40B9B0C19034824287EFAF90A16F35E2
SHA-256:	396170FEA4E992550D750544F405E3148ECE4C5917E2918DE0B471325AB491B5
SHA-512:	FE279D97B779186032D1DF188A1478149E46311A84E85F6D83E9577FBC6DDA1E40F804F3A0C196CC1DB110D98527165D7CAA9A0CC71B2337FB2D8F82CD855631
Malicious:	false
Preview:	.PNG........IHDR...4...4............gAMA......a.....sRGB........?PLTE......C}......^..^..^..^..^..^.........3r.r..R..b...........Q.......tRNS........ .!.<....IDATH.... .E..AA.......om...4.....!p0M..k...j.f....%.".c...@Uj..vX.]}..J.C......L\A.2...5$8H.h...[..).x...M\|.A....A.....H.D+yu."...)^..Cc.L......../.]i,.....xb.a8A>L....V(......./n.i...zF..M..HvG8...C.a}6.......>..A.......N..c.J.1.......P....T?....F.._......6...=....JZ...K..-.....7o[..p....:..K.35a......K.h...r?16#......9!J.........!........Z.[..6.^Cu.uk.g9..[..v....6Ab.l.....IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\background.jpg

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	JPEG image data, baseline, precision 8, 887x557, components 3
Category:	dropped
Size (bytes):	15718
Entropy (8bit):	5.2727938026551895
Encrypted:	false
SSDEEP:	96:qGaoQRTUz999999999999GnaaaaaaaaaaaaaaaaaaaaaaaaaaV:qz8O
MD5:	D1F871DB11D27E5EADC1A75780A8E6F6
SHA1:	852CAB3D306BF0C26C19394BABEF26C1842FD119
SHA-256:	910A53EA0FED371E4BAD6573E947070DB79AAADDAAAB183A1EECD9DAD3953EBC
SHA-512:	90CCC12E3B41787ED47095FE7C857515C6C7CAD95CFF132BEF3804A0161966381E60C111AE802AD4DE9E74DAA8202C4E782669DBF9F0F3C26F08C527CD3C2287
Malicious:	false
Preview:	.............................................................................................................................................o....Adobe.d...........-.w.................................................................................................89rw..X...........!..34.."#$%&'()12567:ABCDEFGHIJQRSTUVWYZabcdefghijqstuvxyz.................................................................................................3.q..4A.....Qb.....R..1.!a........"#$%&'()256789:BCDEFGHIJSTUVWXYZcdefghijrstuvwxyz.......................................................................................?..Ex..\|0...7...`8!...#.7...1.Y......q.7..qk.Cs..:.tQ.B...(..F..4h,..\|q.b&}...=..8fp..G..#.......y.......<3.S....G..;+'k.d..%.{O..N....<.q.Y;Xk'../L...xg.w.........Y<..z`...>S.....$.vVN....K..t......=.y .v..O=.^.;......a.#........y.....=..\|.{..a.H8..5..x.....<3.;..{..A.ed.a..{.0wOi.)....G..;+'k.d..%.{O..N....<.q.Y;Xk'../L...xg.w.........Y<..z`...>S.....$.vVN....K.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\chech-flag.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 18 x 13, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	6.545595182145601
Encrypted:	false
SSDEEP:	24:Gi1h4nQMWwjx82lY2T33VYv54vpLyJ3VNRqvEWv0bGBWiH7rA/jMjLthz:Gg0CNn2r8J3dh2HAghz
MD5:	F86BCBDF68FF380F476FEF5C7001A0AD
SHA1:	1E873C2E6907B7A9239BE272E925312E03B9D959
SHA-256:	D6472B1F31A19F4EBC4D03C752F5EA24410435E443E4583DEA8D148C1BD86D36
SHA-512:	5269D9552CDCE6281B473AEB44CFF2D4F1CB8E3B406C3D9DE688B757F89D56C1572215EBB5C3BBD27AC6B86448DFA98226E03DDF0B86D73C55636524D019DBDD
Malicious:	false
Preview:	.PNG........IHDR.............+,.N....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.4 (Windows)" xmpMM:InstanceID="xmp.iid:2FFE00E7333011EDB671FAE4FDAA80A2" xmpMM:DocumentID="xmp.did:2FFE00E8333011EDB671FAE4FDAA80A2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2FFE00E5333011EDB671FAE4FDAA80A2" stRef:documentID="xmp.did:2FFE00E6333011EDB671FAE4FDAA80A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5..\....IDATx.b...?...........;i..VY....0...8..8......v..{..i...g-H..3.+...k.7..&!..$N.6.....h....<{oJ.Z.6 .Y..t.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\close-button_normal.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 21 x 21, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.755896465897007
Encrypted:	false
SSDEEP:	6:6v/lhPYCnMRUYSaRVF7otQ8/JvWq2T//YJtogcHXb7C/5Ysup:6v/7XnMUYSaxo+kJelT/gMgcHfCCsc
MD5:	4EF2DEBFE89E91CF0B869DBE899EB690
SHA1:	B1ABBBE02BB3E6128C7900DDBB39DA023ABFCC4B
SHA-256:	2AA6B107CAF74A0CDF6F96C8BF232C4CBCD23C1D4AB3A1AFDA6B4F8E16A08F05
SHA-512:	E8AC91317B51E9417E660E3B6EC401C7D404D194881F2364B27EB3FB5109E369A2D28509A9274D13ED97E94167065531EC6A73DC458A47AC8874462C5B203958
Malicious:	false
Preview:	.PNG........IHDR...............U.....gAMA......a.....sRGB........`PLTE.................................................................................................kt.....tRNS.....................{.......A......IDAT...... ..P.TV......_.]dIS^t.8!..cs1..g.N.7.N.S....j.z.0#Uj.=cqHm...A8bZ..f_..uIz.qV^7H{.D...ERyQu...../..V.I.y.w.dFsY.....N......IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\close-button_over.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 21 x 21, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.815772909355884
Encrypted:	false
SSDEEP:	6:6v/lhPYCnMRRNfaRAeAYy/N8Cs90HG086SzTEiYosQ+JXtbKx3s3M1tjp:6v/7XnMLaC1qWHGTHXQs3h1tN
MD5:	1F0E2FB6C9EF512E36D1C2751A718DD0
SHA1:	9962BB50799F9C3E54B75C41CE8D14AC79171EAE
SHA-256:	0F7C92D62627B51B8CA71D6040B6B9622FA9FAC219703BCAA7C4190C9C2496CF
SHA-512:	A0466B0EC8AD1755729D3364F4135FCF5AD4529B28AACBCEB38EB25C556085030DD11EBAA2C4CACCFCB0D5E03BF9ACC95572ACD2F70837063F83743BB0FF920E
Malicious:	false
Preview:	.PNG........IHDR...............U.....gAMA......a.....sRGB........]PLTE.............................................................................................Q*......tRNS....................{........>S......IDAT...... ..P...Zo..Xu..3..eI#/v.8!...R..o..[H.tu.....T.o....aU.37..cn.>%.....o>..^)Z..w.?...i.\|.C,....Fn...U...I....~...\|.....)\......IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\countless_cash_games_icon.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 52 x 52, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.478433851953536
Encrypted:	false
SSDEEP:	12:6v/7n0l+nMztapYYTy+TGWOZUH0DmZ/x3UoF4v0XGCEtda4mflAN8gwmmP:E0iwaSYW+S7ZUZ1Go190d6NAN8dP
MD5:	3AAD55181187EB922BF888A05875FE03
SHA1:	00629184D77E0082CBE16A4ECFDE03BF51C1CE3B
SHA-256:	7785DEFF4991BF4492BD0FDDC8EDAC1935069070EB55B7F7847BDEC63DD67C87
SHA-512:	BFE804E335D024F11D07B6BB3D6B8C8762A3226B682F048C2323C8D2552F90DDB42702832D41E8816F3C926C26E19039E2638A4C5A1DBFE8CBC825EB726BB67C
Malicious:	false
Preview:	.PNG........IHDR...4...4............gAMA......a.....sRGB........?PLTE............^..^..^..^..^..^...C}..........R..b.......r..3r..&......tRNS........ .!.<....IDATH.... .E..`7a....a....<t.......,......].}.m.T.ge.l...#&R.c..~.c.>w.\..ua/.......TB2.....d..f._.)N..S....?..GP..5o....#....(........{.%U.h......C.Q...l\|...../I/.tFK..q8./_.=..8.....[eaX'..G..........U.qyg/..Cu.'.b(.X...7..:...[%.1T.s....TW.`k...{.]I..RyW.{SUS...h]...._... ...)..........).....7....1...*...@...z...'P..1.F.{.....HJ"3H. .R.g.2m:.KJ.SH.&BN.N..$#wA...y8Aq....HlL5.C...././.'wom.l[.....rQ...G}\|?...F...7...\|uQ...^....w...mY~.3.....q...#94aR.....IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\cta-button_normal.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 240 x 57, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.085343289034802
Encrypted:	false
SSDEEP:	6:6v/lhP2otEnMRPNaSVBxt/+6ft8TB3ytE/cLdXHXVryEp:6v/7eoWnM5xtb4wthZXHXVryG
MD5:	9EFEFE5516895B085783A1D59BDADF79
SHA1:	E1C4345F847A3755C04505EA57E6D8D4737128E0
SHA-256:	FE7B5AF65ED5A8D484712DC4255511F3D878B8BEE63ED0032B01504A9D21E7D0
SHA-512:	733DD9D077D01853C3110F97A1EC4E650666F75C5162595C0E5BBDCF6001B5B2AF14677FDA41BD13D5827EE6623E01500AC1BB56192D285874E636AF0469BED5
Malicious:	false
Preview:	.PNG........IHDR.......9.............gAMA......a.....sRGB.........PLTE(..(..(.....(..(..(..(..(..(..dD......tRNS.'....%.(.\|.....^IDATX.....@.D..........qHz.!..n)c.....[...]s-=.YS.~.e.z(0.....`0.....`0..........'.za................IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\cta-button_over.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 240 x 57, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.148772809860563
Encrypted:	false
SSDEEP:	6:6v/lhP2otEnMRPDaqGq8v+6ft8TB3ytE/cLdXHXVryEp:6v/7eoWnM7a68r4wthZXHXVryG
MD5:	8FC80FEC92D6032984C8E45B024C2AB6
SHA1:	1ED5322F73577934F7A071682FF402388DEA16C0
SHA-256:	168A059AC374EF668E1467B5D6069BB7E6AA2E752852EFD3E3D320D2E388BA65
SHA-512:	024C38DC152A6371383A782B6D7099F9184C093191BD6B8CCD6638EF7F74DE70A1DB85205F0A7547A2CCC8BA6F3D08DBD93FFC243FD41A5BD69EBCB9B2B5F6C6
Malicious:	false
Preview:	.PNG........IHDR.......9.............gAMA......a.....sRGB.........PLTEf..f..f.....f..f..f..f..f..f..-.>=....tRNS.'....%.(.\|.....^IDATX.....@.D..........qHz.!..n)c.....[...]s-=.YS.~.e.z(0.....`0.....`0..........'.za................IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\estonia-flag.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 18 x 13, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	6.129742738607096
Encrypted:	false
SSDEEP:	24:Gi1h4nQMWwjx82lY2T33VqOyJ3VYRExGEgvnqP1:Gg0CNn2r6J3ZZqY1
MD5:	081B13AD26CC2D9576A050B9A6445C56
SHA1:	84F781B84C104521E781FD02D72334E0FAA6273E
SHA-256:	8110564299DC75ED1DB3A60EDFDDF1F876FFA9A857BD0F6FFA4E9D573F9334B9
SHA-512:	7016AE5D451ECC973A514CAB829B8F2B7BE55C68D66605FB3C7237B3FA83C1926B8615EB41E65367C1276E5AE3A8E972784B154DEF08BD04CA3357024EB88305
Malicious:	false
Preview:	.PNG........IHDR.............+,.N....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.4 (Windows)" xmpMM:InstanceID="xmp.iid:66F39C78333011EDA4EAEF784502A140" xmpMM:DocumentID="xmp.did:66F39C79333011EDA4EAEF784502A140"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66F39C76333011EDA4EAEF784502A140" stRef:documentID="xmp.did:66F39C77333011EDA4EAEF784502A140"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.\....eIDATx..1..0.E./.. Z....z....H....7$.#..m...&..3.D...2....Y.,8...w+.`...'..9.....43U.=M.j.Z.}...e'..i....

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\greek-flag.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 18 x 13, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.881418295943823
Encrypted:	false
SSDEEP:	3:yionv//thPl9lmqRthwkBDsTBZt3jm2Q7YhhZHryx2ObL0p3F0inVp:6v/lhPLlmWnDsp3y4HO0phVp
MD5:	8E30747DF1A92097671555182F4B4F08
SHA1:	98E151A8E9707D56357AA8D2696153E9B8ACAAE3
SHA-256:	BA969182F7A443279960605F48ABD1AFB1CCBA66A24C330A64AB804476CB3C6D
SHA-512:	3153F2B70A0DA4C4EEE4C261E83B9496812BC6633A8012A542DFF51AC0FAEAF206A854BB1A8C0B08F48CEDED6F818FD3D678F13F69010B00B468EB91DE7A9521
Malicious:	false
Preview:	.PNG........IHDR................+....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.S...........l........3IDATx.b```eae@.`!F...1!............Y.B#......`...`....1........IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\logo.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 194 x 42, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3008
Entropy (8bit):	6.727190953963264
Encrypted:	false
SSDEEP:	48:8TupbyprPmZHiTq0A14HMfe9hvsDp2cCz883r0rQM8ap/SPxNb0N:8TupbypDm4Of19eCUHwGrPTTA
MD5:	26A49A1D2D15B9F56012566B7EDCBC3D
SHA1:	AA86E01EE04051575B3DEA741A142CAFAD07C41A
SHA-256:	71ECA3F1F564CC8F559D112A354A3799FC9F01047C56AEC89B5F1021EC5EFA29
SHA-512:	72C4A9A676BC90B79FA399AC21E0F9A305F347ED514B8FDE425C5C52345C39936A568722F13CC387CABA1FD01C7BBF09F222785AB7D175B33206805EF6E7E744
Malicious:	false
Preview:	.PNG........IHDR.......*......(t.....gAMA......a.....sRGB.........PLTE................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................tRNS..z.1sh.....]......%..-..~.......u..............P.......RI..o+"..?O.}.W.r.A........0p...l.m..ZV.\{.&qj..X..M./....T.D.d.!..g.2.. .H..t.nG..#..86.a4.=........5..`(;...v

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\progress-bar.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 629 x 15, 1-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	119
Entropy (8bit):	5.0879307884453056
Encrypted:	false
SSDEEP:	3:yionv//thPnfkidlclhCX9/ZMLts8yNfxHgGFMshP6t/2g1p:6v/lhPfk+W7CnMRPy1dDhhP612up
MD5:	A739CEC24DAA55D321D27CE460E83DAD
SHA1:	7FB5630FD48C45D7873D11375D1CE912C0E3BBC7
SHA-256:	30371CC12397902EDDBA358C32E7B2384B1425F3E703B94ECFD73D316177F123
SHA-512:	259B6271C884D5AB79D4F11DBFC6E1FABAE977E4FF67AF2E4373ED425CCA22C11D4BAD52D0557288875D3AAA61C38C7CAAD21BECC436C795336F5EA2F429A1D5
Malicious:	false
Preview:	.PNG........IHDR...u.................gAMA......a.....sRGB.........PLTE(..^.......IDAT8.c`...`............7.....IEND.B`.

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\sprite.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 415 x 547, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20214
Entropy (8bit):	7.939126573505643
Encrypted:	false
SSDEEP:	384:FIZ4qT1u8xTBu1Y8Wpy79mr519PCSJjAEOStK+v6QnnUkqSHPXz/O:FIZ4qT1txTEYP89OLPtA9Kv6QnUkqS/C
MD5:	4A9E6334B9D97619ADD9ABB42363C214
SHA1:	D5105E86F50DC45F76B02F5CE32D6580973BB478
SHA-256:	D0C9FEBB5511A7769149E1BA6A57CEAFDF4ABED383E11EB18E5EF026930C4B1A
SHA-512:	C6867D93344BEBA6CA3B424484523A0384260A6B5C36ABBFEF7396ED01432A748C7BB7D5D2748991D3FDD63517F2C700E6B012FD8BC02889D9FE8C0F5261FC9D
Malicious:	false
Preview:	.PNG........IHDR.......#........... .IDATx......U.>....m.KzB....B....#M@i..h..R,.K//HQ...(`A..Q.^.....H%.'..^n......{w.%!.K./.%.{..2g.<..\../.}...`y.n..o.....D1.t;N......ga.Z.........b.(.....>...>..........S..kB.&\.`x.,..c.].a..`.....c"....o}.....Q....\.EQd.T.x.J8q...F....v.z........w.../...+.....C.....<x..WQ..2.X......0`z..eB%.P.(.T..t....R.</....0........ztx...k@)...!..!...HG..H.`..0<(.@.2a.)8...K.....D<...1l...$m.....hL#.qa..`(......)...\.....5........................=.vG..~.Lt,[....c....h..P.r1.... o.hkE.U.......G.x...TT..Rp=..rdK.mjz..A.pr.$.X......@....4...il=\|.T2.SJ.!...R$W..l...q<x.E...cH...2.].v.......7..$.......V...<......Y^......~z%.....`.....\.f....<.J..x....?.d,n.]..gRQ...g....a...8...hO.@....P..~.0P.q..#^.........0.D"..R.....A......#..q....\.."..WPUR..0.).v(.%E....\|&....$m.`...p.....6R0..Qj.I3..bp3id..D.......qa..Rp].9..~..,.!~...j..;i2.^.5?......,)..N.!.m........K>."*JK.>+....=....})..=.#.d.:...u.'[........Z......`.l.4.S\|.x......Z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new\images\thrilling_casino_games_icon.png

Download File

Process:	C:\Users\user\Desktop\SetupPoker.exe
File Type:	PNG image data, 52 x 52, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.492659799535168
Encrypted:	false
SSDEEP:	12:6v/7n0l+nMzta7VVUBTtxNGg46F8YXXCX49j4vvf7uU028J5Uf:E0iwa7cBXNGg46F8UXc49j4vvTW28JWf
MD5:	4D1A905E5B89739B20CBA186DF357E1F
SHA1:	1C4B4D6806C49C5FB88B05DBD1E4629C9347032B
SHA-256:	DDCCB1F0B9B39E8F66B71A4FBC84BEE310E932A0B732780CCCEB87CFD9D1E0BC
SHA-512:	6C62ECCC8DF6596F8096CD9B8EF3F6F196716DB59903A0B054601EF964868D2FAF4ACD1BD5088B1969B93E8A1A7263C6D0614D8B8E391A65FBAA7291239A3632
Malicious:	false
Preview:	.PNG........IHDR...4...4............gAMA......a.....sRGB........?PLTE.........3r...^..^..^..^..^..^.........b.........C}.R..r...........tRNS........ .!.<....IDATH.... .@K.A.P.....%,.Am...c[.!+Y.]....Bn..R....{F~n..~.t......>.iyL.y...~.j`.U...\|`U..I.t...Z.@..G6..........B..(.G...5....!?K...5.B..q.Z ...C.."....+P.d:.V.ef_.?k.r#;4:...$..QF.(%.....+{..\|.....+C..b.F......)....%.A.)BU..=..k.6m.Y...U.I&.m.3..bJ(..!...B.....:+....1N.L..hx.(k..Q....@.+d.rI..-I..B.'.>@iM.P...?./.@a..=...A*....-.1.#\|..hp..m...9v[..vU.i.9.nN.mO.=.T..I....%.siouL.5.:L.ci.ci...n\..".^..0........T..i....[.;.......RXs.S..%M...o.[..-_..R,..../.o....h....0.......k...mY~.g~.hyr...Ar;.c.O.....IEND.B`.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.52844431094888
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SetupPoker.exe
File size:	810'528 bytes
MD5:	343388c9516bc04f4ed06d6f1353f602
SHA1:	b124bf52a708dc990ed302519b434fac3565e190
SHA256:	33fe69e83c850f8b4b090b862cb38648a77c68f251cd6e9bd975ac2aa917ac05
SHA512:	ba7a7461b8c4442ec1b0c49c996a507dffd4dfe933c8ed0b2daf35d893c97a0de367414336cb004d37112f6084e141ea907510323b2bafc50da510ed44d06e0d
SSDEEP:	12288:qqgCPAR//hBRGHa7A6wuJIVQUb/s16jWYHUiN+4cDBNAuu7kzA:I4AR//hwefXJI6UKY0l4WyuugzA
TLSH:	68056C207682C43AE6B201725A7C9F6A103EFB600F7591DB67C85B6E19B44D64E33F1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................^+B.....^+@.O...^+A.......................................0............... .....}.......x.L.......$.....}......

File Icon


Icon Hash:	a011e2ee74601760

Static PE Info

General

Entrypoint:	0x45ea75
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63319F06 [Mon Sep 26 12:45:58 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	84a6bf37d5a5037b8edbf379dfcb0744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	27/01/2022 01:00:00 28/01/2024 00:59:59
Subject Chain	CN=Playtech Software Limited, O=Playtech Software Limited, L=Douglas, C=IM
Version:	3
Thumbprint MD5:	A3DA963AA3EE7ADC6F8A8E495F4E19DD
Thumbprint SHA-1:	12812AF71C94F37EADF56B84B5EEC31B367B6FBC
Thumbprint SHA-256:	9BD04ACF6B98AF6785C8D1EC1E6999D52E1874CC8248D071FBE2148742A710CA
Serial:	0D9334C2A837B2B993AD4FA69FAC6225

Entrypoint Preview

Instruction
call 00007FC61C9881C1h
jmp 00007FC61C987783h
cmp ecx, dword ptr [004B3014h]
jne 00007FC61C9878F5h
ret
jmp 00007FC61C987E1Ch
jmp 00007FC61C987962h
push ebp
mov ebp, esp
jmp 00007FC61C987911h
push dword ptr [ebp+08h]
call 00007FC61C99B5EEh
pop ecx
test eax, eax
jne 00007FC61C987904h
cmp dword ptr [ebp+08h], FFFFFFFFh
jne 00007FC61C9878F9h
call 00007FC61C9885A4h
jmp 00007FC61C9878F7h
call 00007FC61C988CC2h
push dword ptr [ebp+08h]
call 00007FC61C98EBB2h
pop ecx
test eax, eax
je 00007FC61C9878C6h
pop ebp
ret
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FC61C987924h
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
pop ebp
jmp 00007FC61C9878ABh
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0048C6B4h
je 00007FC61C9878FCh
push 0000000Ch
push esi
call 00007FC61C9878C4h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
jmp 00007FC61C98EB77h
push ebx
push esi
push edi
push 00000000h
push 00000FA0h
push 004B6400h
call 00007FC61C98BC29h
add esp, 0Ch
push 00499B20h
call dword ptr [0048C134h]
mov esi, eax
test esi, esi
je 00007FC61C987982h
push 0048C6B8h
push esi
call dword ptr [0000C130h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb02bc	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe000	0x6940	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc3600	0x2820
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc5000	0x841c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa25b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa267c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa2620	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8c000	0x54c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8a41b	0x8a600	52a8d1090ce57c8e478a8444f17b2d2e	False	0.4814267869241192	data	6.545607574317553	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8c000	0x26054	0x26200	09f4d2005e7a713937aa24bad55a040b	False	0.3750768442622951	data	4.841277412887058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb3000	0x88e0	0x3400	7d60eb8f3bcb653ae844aaa56042dc31	False	0.22408353365384615	data	4.619214425229525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0xbc000	0x268	0x400	28dea72aece4fb7e20d18067738d47a1	False	0.3623046875	data	2.6271991446043943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xbd000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xbe000	0x6940	0x6a00	931d0c72574b0b41433fe2f58191b1ff	False	0.4641804245283019	data	5.4609600244279	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc5000	0x841c	0x8600	4241ec7203485c6124ac9fa9c5443cb6	False	0.6419659514925373	data	6.6037924345495895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DATA	0xc3fd8	0x475	JSON data	English	United States	0.43470639789658194
PNG	0xc1e88	0x214f	PNG image data, 437 x 268, 8-bit/color RGBA, non-interlaced	English	United States	0.957898440248622
RT_ICON	0xbe3a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.4716312056737589
RT_ICON	0xbe808	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.2718105065666041
RT_ICON	0xbf8b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.11732365145228216
RT_DIALOG	0xbe2f0	0xaa	data			0.6705882352941176
RT_DIALOG	0xbe2b0	0x40	data			0.671875
RT_GROUP_ICON	0xc1e58	0x30	data	English	United States	0.8125
RT_VERSION	0xc4450	0x2c4	data	English	United States	0.4477401129943503
RT_MANIFEST	0xc4718	0x224	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators	English	United States	0.531021897810219

Imports

DLL	Import
gdiplus.dll	GdipAlloc, GdipSetSmoothingMode, GdipCreateSolidFill, GdipFree, GdipCreateFromHDC, GdipFillRectangleI, GdipDeleteGraphics, GdipSetPenMode, GdipDeletePen, GdipCreatePen1, GdiplusStartup, GdiplusShutdown, GdipDeleteBrush, GdipGetImageHeight, GdipCloneImage, GdipCreateBitmapFromStream, GdipDrawImageRectI, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipGetImageWidth, GdipCreateBitmapFromFile, GdipReleaseDC
WININET.dll	InternetCrackUrlW, HttpSendRequestW, InternetCloseHandle, HttpQueryInfoW, InternetSetOptionW, InternetReadFile, InternetOpenW, InternetQueryOptionW, HttpOpenRequestW, InternetConnectW, InternetGetConnectedState
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
KERNEL32.dll	QueryPerformanceFrequency, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, DeleteCriticalSection, HeapFree, InitializeCriticalSectionAndSpinCount, HeapSize, GetLastError, HeapReAlloc, RaiseException, HeapAlloc, DecodePointer, HeapDestroy, GetProcessHeap, GetVersionExW, ReadFile, GetStdHandle, WriteFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, MultiByteToWideChar, WideCharToMultiByte, CreateDirectoryW, GetFullPathNameW, lstrlenW, RemoveDirectoryW, SetFileTime, CreateFileW, SetFileAttributesW, DeleteFileW, CloseHandle, FindFirstFileW, FindNextFileW, FindClose, SetFilePointer, SetEndOfFile, GetFileSize, GetSystemInfo, GetProcAddress, GetModuleHandleW, VirtualFree, VirtualAlloc, InitializeCriticalSection, WaitForSingleObject, CreateEventW, SetEvent, GetTimeZoneInformation, FlushFileBuffers, GlobalHandle, SetLastError, InterlockedDecrement, GetModuleFileNameW, GetCurrentThreadId, Sleep, LockResource, GlobalAlloc, GlobalFree, FindResourceExW, LoadResource, FindResourceW, GlobalLock, FreeLibrary, InterlockedIncrement, lstrcmpiW, GlobalUnlock, lstrcmpW, MulDiv, LoadLibraryExW, GetSystemDefaultLCID, GetProcessId, LocalAlloc, LocalFree, GetExitCodeProcess, CreateThread, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, GetCurrentProcessId, GetFileAttributesW, UnmapViewOfFile, FlushViewOfFile, CreateFileMappingW, MapViewOfFile, CopyFileW, lstrlenA, GetCurrentProcess, TerminateProcess, GetEnvironmentVariableW, GetLongPathNameW, GetVersion, WaitForSingleObjectEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, OutputDebugStringW, EncodePointer, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, LoadLibraryExA, GetConsoleCP, GetConsoleMode, SetFilePointerEx, GetLocalTime, ExitProcess, GetACP, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ResetEvent, GetFileType, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, RtlUnwind, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetStdHandle, WriteConsoleW, ReadConsoleW, SizeofResource
USER32.dll	EnableWindow, SetLayeredWindowAttributes, SetMenuDefaultItem, SetMenuItemInfoW, CheckMenuRadioItem, GetMenuItemInfoW, ShowWindow, IsWindow, InvalidateRgn, DispatchMessageW, SetTimer, RedrawWindow, IsDialogMessageW, ClientToScreen, DestroyAcceleratorTable, PeekMessageW, IsChild, SetDlgItemTextW, GetSysColor, MoveWindow, UnhookWindowsHookEx, CreateAcceleratorTableW, SetFocus, EndDialog, GetWindowLongW, LoadCursorW, GetClassNameW, SetCapture, SetWindowsHookExW, SetWindowLongW, GetClientRect, GetDlgItem, KillTimer, PostQuitMessage, SendDlgItemMessageW, SetWindowContextHelpId, MapDialogRect, GetWindowRect, RegisterClassW, ValidateRect, LoadIconW, UpdateLayeredWindow, UpdateWindow, GetWindowThreadProcessId, GetWindowTextLengthW, GetMessageW, DefWindowProcW, CallWindowProcW, GetWindow, GetFocus, DestroyWindow, GetDC, SetWindowPos, MessageBoxW, FillRect, CreateWindowExW, ScreenToClient, SendMessageW, PostMessageW, SwitchToThisWindow, CharNextW, EnumWindows, GetDesktopWindow, CreateDialogIndirectParamW, SystemParametersInfoW, GetClassInfoExW, GetParent, RegisterWindowMessageW, ReleaseCapture, InvalidateRect, ReleaseDC, BeginPaint, EndPaint, GetWindowTextW, UnregisterClassW, CharUpperW, CallNextHookEx, SetWindowTextW, TranslateMessage, RegisterClassExW
ADVAPI32.dll	RegDeleteValueW, LookupPrivilegeValueW, AdjustTokenPrivileges, OpenProcessToken, RegOpenKeyExW, RegSetValueExW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegQueryInfoKeyW, RegCloseKey, RegQueryValueExW, GetTokenInformation, RegSetValueW, LookupAccountSidW
ole32.dll	CoGetClassObject, OleUninitialize, CoTaskMemAlloc, CoCreateGuid, StringFromGUID2, CoCreateInstance, CLSIDFromProgID, CoTaskMemFree, CreateStreamOnHGlobal, OleInitialize, CoTaskMemRealloc, CLSIDFromString, OleLockRunning
SHELL32.dll	ShellExecuteW, SHGetDesktopFolder, SHGetPathFromIDListW, SHBrowseForFolderW, SHFileOperationW, SHCreateDirectoryExW, ShellExecuteExW
OLEAUT32.dll	DispCallFunc, LoadRegTypeLib, VariantInit, LoadTypeLib, OleCreateFontIndirect, SysStringLen, SysAllocStringLen, VarUI4FromStr, VariantCopy, VariantClear, SysFreeString, SysAllocString
SHLWAPI.dll	UrlEscapeW, PathIsDirectoryEmptyW
GDI32.dll	CreateSolidBrush, GetObjectW, DeleteDC, GetDeviceCaps, GetStockObject, CreateCompatibleDC, SelectObject, CreateCompatibleBitmap, BitBlt, CreateDIBSection, DeleteObject
CRYPT32.dll	CertGetNameStringW, CertFindCertificateInStore, CryptMsgGetParam, CryptMsgClose, CertFreeCertificateContext, CryptQueryObject, CertCloseStore
PSAPI.DLL	GetModuleFileNameExW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 14:31:42.279937983 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:42.581381083 CEST	80	49697	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:42.581554890 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:42.581703901 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:42.795809031 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:42.795881033 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:42.795979023 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:42.806153059 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:42.806190968 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:42.882925987 CEST	80	49697	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:42.884119034 CEST	80	49697	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:42.884143114 CEST	80	49697	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:42.884202957 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:42.884203911 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:42.891504049 CEST	49697	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:43.150748014 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:43.150865078 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:43.192805052 CEST	80	49697	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:43.209753990 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:43.209805012 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:43.210818052 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:43.210891008 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:43.213793993 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:43.260123968 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.022345066 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.022459984 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.044688940 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.044703960 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.044744015 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.044783115 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.044792891 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.044820070 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.044847965 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.071445942 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.071475983 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.071595907 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.071604967 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.071647882 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.195130110 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.195173025 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.195333004 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.195368052 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.195410967 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.226290941 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.226311922 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.226418972 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.226428986 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.226473093 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.255369902 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.255405903 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.255531073 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.255563021 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.255604982 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.282257080 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.282278061 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.282354116 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.282361984 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.282402039 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.355081081 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.355102062 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.355176926 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.355185986 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.355223894 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.375663996 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.375730991 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.375758886 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.375775099 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.375787973 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.375813961 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.397886038 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.397917032 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.397970915 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.398003101 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.398020029 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.398050070 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.418536901 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.418586016 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.418626070 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.418642044 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.418667078 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.418689966 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.439929962 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.439975977 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.440020084 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.440046072 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.440069914 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.440118074 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.460880041 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.460921049 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.460964918 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.460987091 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.461011887 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.461035013 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.479413986 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.479434013 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.479504108 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.479526043 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.479588985 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.496933937 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.496978045 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.497024059 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.497037888 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.497067928 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.497087955 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.513855934 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.513899088 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.513936043 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.513952971 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.513978958 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.514003038 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.524175882 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.524238110 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.524255991 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.524274111 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.524297953 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.524319887 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.537781954 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.537823915 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.537869930 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.537889004 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.537915945 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.537935019 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.549851894 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.549895048 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.549954891 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.549954891 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.549972057 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.550031900 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.562561035 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.562603951 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.562649012 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.562663078 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.562691927 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.562721014 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.575508118 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.575529099 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.575629950 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.575644016 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.575707912 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.577383041 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.577452898 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.577467918 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.577512980 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.577533007 CEST	443	49698	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:44.577558994 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.577558994 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:44.577603102 CEST	49698	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.237062931 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.237119913 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.237247944 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.237508059 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.237520933 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.292026043 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.309158087 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.309201002 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.309282064 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.309500933 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.309511900 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.563764095 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.563852072 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.564320087 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.564327002 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.565865993 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.565871954 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.593427896 CEST	80	49700	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:46.593568087 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.593700886 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.634679079 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.634831905 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.635301113 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.635313034 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.637124062 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.637135029 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.895246029 CEST	80	49700	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:46.896572113 CEST	80	49700	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:46.896629095 CEST	80	49700	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:46.896734953 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.896735907 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.896864891 CEST	49700	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:46.955020905 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.955121994 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.977022886 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.977032900 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.977073908 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.977111101 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:46.977128983 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:46.977173090 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.003928900 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.003978968 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.004026890 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.004041910 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.004071951 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.004091024 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.128545046 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.128575087 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.128700972 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.128726006 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.128767967 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.152924061 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.153119087 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.153141975 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.153186083 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.153215885 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.153234005 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.180193901 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.180248976 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.180352926 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.180368900 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.180380106 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.180404902 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.197928905 CEST	80	49700	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:47.206823111 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.206849098 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.206934929 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.206975937 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.207019091 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.288278103 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.288330078 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.288372040 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.288393974 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.288409948 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.288430929 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.312632084 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.312678099 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.312725067 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.312745094 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.312762976 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.312783957 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.331984997 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.332007885 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.332094908 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.332128048 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.332166910 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.356415987 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.356503010 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.356539965 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.356560946 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.356574059 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.356597900 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.368170023 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.368268967 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.368282080 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.368334055 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.389729023 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.389775991 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.389828920 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.389842033 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.389856100 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.389883041 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.409401894 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.409442902 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.409487963 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.409499884 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.409521103 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.409539938 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.434499979 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.434518099 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.434596062 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.434608936 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.434649944 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.447643042 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.447704077 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.447736979 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.447772980 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.447798967 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.447838068 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.447861910 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.447879076 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.447910070 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.447932959 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.448018074 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.448071957 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.449807882 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.449851990 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.449898958 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.449918032 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.449948072 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.449958086 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.451843977 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.451910973 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.465673923 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.465744019 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.465761900 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.465775967 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.465804100 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.465821981 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.479794025 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.479830027 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.479940891 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.479969025 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.479983091 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.480015039 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.492722988 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.492785931 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.492825985 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.492844105 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.492863894 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.492897987 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.505568981 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.505614042 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.505646944 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.505662918 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.505681038 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.505701065 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.517486095 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.517533064 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.517579079 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.517597914 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.517620087 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.517640114 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.525285006 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.525358915 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.525372028 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.525454998 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.525460958 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.525505066 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.525604010 CEST	49701	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.525619984 CEST	443	49701	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557128906 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557189941 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557251930 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.557251930 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.557285070 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557329893 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.557352066 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557409048 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.557449102 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:47.557543993 CEST	443	49699	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:47.557595968 CEST	49699	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.328483105 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.328564882 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.328752041 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.329056978 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.329096079 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.441772938 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:51.469973087 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.470011950 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.470086098 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.470438004 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.470452070 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.661515951 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.661717892 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.662174940 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.662193060 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.673078060 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.673089027 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.743535042 CEST	80	49707	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:51.743690968 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:51.743851900 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:51.799370050 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.799540043 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.800224066 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.800237894 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:51.802371979 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:51.802378893 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.028624058 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.028650999 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.028683901 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.028775930 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.028814077 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.028855085 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.028887987 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.045485973 CEST	80	49707	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:52.046868086 CEST	80	49707	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:52.046890974 CEST	80	49707	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:52.046942949 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:52.046967030 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:52.047064066 CEST	49707	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:31:52.050880909 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.050931931 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.050966024 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.050971985 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.051038980 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.051399946 CEST	49706	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.051417112 CEST	443	49706	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.118784904 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.118916988 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.141344070 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.141376972 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.141424894 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.141511917 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.141546011 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.141562939 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.141608000 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.168095112 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.168159962 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.168334007 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.168356895 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.168440104 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.292865038 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.292917967 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.292982101 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.293000937 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.293061018 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.324064970 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.324141979 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.324198008 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.324213982 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.324238062 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.324268103 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.348535061 CEST	80	49707	52.213.137.28	192.168.2.16
Apr 24, 2024 14:31:52.353092909 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.353142023 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.353207111 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.353219032 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.353266954 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.437849998 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.437911034 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.437946081 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.437978029 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.438000917 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.438013077 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.458921909 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.458992958 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.459022999 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.459058046 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.459079027 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.459116936 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.479835033 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.479863882 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.479935884 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.479950905 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.479964972 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.480003119 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.502830029 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.502893925 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.502949953 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.502995014 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.503015041 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.503045082 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.527122974 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.527189016 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.527245998 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.527259111 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.527297020 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.527314901 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.547604084 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.547653913 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.547694921 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.547709942 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.547733068 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.547743082 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.565576077 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.565607071 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.565665007 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.565675020 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.565711975 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.585269928 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.585294008 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.585366011 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.585376978 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.585421085 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.608114004 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.608145952 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.608225107 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.608244896 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.608290911 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.622776031 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.622797012 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.622869015 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.622879982 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.622924089 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.638137102 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.638186932 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.638226032 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.638237000 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.638252020 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.638277054 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.651985884 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.652007103 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.652076960 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.652086973 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.652152061 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.665318012 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.665335894 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.665415049 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.665425062 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.665466070 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.677510023 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.677526951 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.677598000 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.677607059 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.677649021 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.689093113 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.689138889 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.689171076 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:31:52.689222097 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.689255953 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.689404011 CEST	49708	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:31:52.689431906 CEST	443	49708	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.018934011 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.018990040 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.019110918 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.019371986 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.019390106 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.143603086 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.171631098 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.171669006 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.171952963 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.172125101 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.172136068 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.349387884 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.349555969 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.350073099 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.350085974 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.352567911 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.352574110 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.445173979 CEST	80	49714	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:00.445344925 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.445686102 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.503607988 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.503771067 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.505832911 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.505832911 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.505846024 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.505858898 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.668138981 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.668232918 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.690586090 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.690608978 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.690684080 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.690700054 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.690700054 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.690717936 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.690732956 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.690757036 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.690788984 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.712672949 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.712730885 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.712764978 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.712773085 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.712800026 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.712937117 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.712943077 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.713016987 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.713041067 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.713041067 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.713068008 CEST	49713	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.713076115 CEST	443	49713	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.747102022 CEST	80	49714	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:00.748384953 CEST	80	49714	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:00.748421907 CEST	80	49714	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:00.748446941 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.748526096 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.748526096 CEST	49714	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:00.822278023 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.822472095 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.844676018 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.844685078 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.844707012 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.844752073 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.844760895 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.844773054 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.844841003 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.871359110 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.871382952 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.871483088 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.871483088 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.871491909 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.871639013 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.875849962 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.875914097 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.999733925 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.999762058 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:00.999922991 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:00.999933958 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.000015020 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.021904945 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.021986008 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.021997929 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.022048950 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.049910069 CEST	80	49714	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:01.050935984 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.050967932 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.051007986 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.051021099 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.051045895 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.051240921 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.141366005 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.141387939 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.141494036 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.141504049 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.141541004 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.146373987 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.146439075 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.168792009 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.168867111 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.168946981 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.168946981 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.168955088 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.168983936 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.189310074 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.189338923 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.189379930 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.189388037 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.189421892 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.189449072 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.197865009 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.197953939 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.218569994 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.218585014 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.218635082 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.218647957 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.218712091 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.239895105 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.239912033 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.239969969 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.239994049 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.240020037 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.240020037 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.246088028 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.246176958 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.267133951 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.267149925 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.267189980 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.267266035 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.267271996 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.267312050 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.286585093 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.286601067 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.286765099 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.286773920 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.286978006 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.311619997 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.311647892 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.311697960 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.311708927 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.311743021 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.311803102 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.313859940 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.313919067 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.326438904 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.326478004 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.326508999 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.326513052 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.326591969 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.339714050 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.339731932 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.339829922 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.339837074 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.339885950 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.353648901 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.353667021 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.353741884 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.353750944 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.353925943 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.366318941 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.366343021 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.366535902 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.366545916 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.366605043 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.379021883 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.379062891 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.379093885 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.379098892 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.379167080 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.379167080 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.390722036 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.390742064 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.390821934 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.390830994 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.391011953 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392685890 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.392748117 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392751932 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.392765999 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.392817020 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392817020 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392826080 CEST	443	49715	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:01.392833948 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392868042 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:01.392868042 CEST	49715	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.603445053 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.603482008 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.603560925 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.603842974 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.603857040 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.690560102 CEST	49717	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:10.732125998 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.732176065 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.732258081 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.732472897 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.732491016 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.935461044 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.935555935 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.936033964 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.936038971 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.937669992 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:10.937675953 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:10.986677885 CEST	80	49717	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:10.986771107 CEST	49717	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:10.986949921 CEST	49717	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:11.057919979 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.058017015 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.058521032 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.058538914 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.060781002 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.060795069 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.254235029 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.254345894 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.276485920 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.276531935 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.276572943 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.276576042 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.276602983 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.276628017 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.276638985 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.276657104 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.276693106 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.282896042 CEST	80	49717	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:11.284229994 CEST	80	49717	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:11.284241915 CEST	80	49717	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:11.284303904 CEST	49717	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:11.284383059 CEST	49717	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:11.298697948 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.298742056 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.298788071 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.298794985 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.298835039 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.298882008 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.298954010 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.299057007 CEST	49716	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.299067020 CEST	443	49716	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.400084019 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.400121927 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.400196075 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.400217056 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.400243044 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.400254011 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.400284052 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.400312901 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.426929951 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.426948071 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.427025080 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.427038908 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.427094936 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.548275948 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.548291922 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.548422098 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.548439980 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.548499107 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.579447985 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.579473972 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.579560995 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.579581022 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.579644918 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.580312967 CEST	80	49717	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:11.608448982 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.608463049 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.608566999 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.608580112 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.608639002 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.696655989 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.696672916 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.696768045 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.696799040 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.696857929 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.717242956 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.717264891 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.717346907 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.717406988 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.717466116 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.738106012 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.738121033 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.738234043 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.738250017 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.738313913 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.760029078 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.760046005 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.760183096 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.760202885 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.760261059 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.783595085 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.783610106 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.783711910 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.783771038 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.783828974 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.803759098 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.803776979 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.803844929 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.803862095 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.803911924 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.821857929 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.821873903 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.821944952 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.821957111 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.822031021 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.855978012 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.855994940 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.856080055 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.856097937 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.856162071 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.869456053 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.869473934 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.869546890 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.869558096 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.869795084 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.884644032 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.884659052 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.884730101 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.884742975 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.884783030 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.900121927 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.900136948 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.900202036 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.900208950 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.900252104 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.914179087 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.914194107 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.914252996 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.914261103 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.914299965 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.926594973 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.926609993 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.926680088 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.926687002 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.926815987 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.939950943 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.939966917 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.940032959 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.940040112 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.940088034 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.951448917 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.951483011 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.951524019 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:11.951539040 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.951594114 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.951680899 CEST	49718	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:11.951697111 CEST	443	49718	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.296909094 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.296993971 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.297100067 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.297761917 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.297800064 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.378173113 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.411981106 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.412019968 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.412115097 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.412400007 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.412415028 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.634990931 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.635104895 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.635603905 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.635636091 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.637267113 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.637280941 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.674451113 CEST	80	49720	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:24.674586058 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.674752951 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.737221003 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.737792015 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.738115072 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.738126040 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.739830017 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.739840031 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.953598976 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.953668118 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.970607996 CEST	80	49720	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:24.971838951 CEST	80	49720	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:24.971873999 CEST	80	49720	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:24.971904993 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.971940994 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.971965075 CEST	49720	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:24.975987911 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.976001024 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.976037025 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.976066113 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.976083040 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.976111889 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.976155996 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998250008 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.998339891 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998419046 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.998477936 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998533964 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.998573065 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998620033 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998655081 CEST	443	49719	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:24.998661995 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:24.998697996 CEST	49719	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.056560040 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.056624889 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.078993082 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.079001904 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.079056978 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.079071045 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.079087973 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.079108000 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.079144955 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.105767012 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.105782986 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.105860949 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.105874062 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.106029987 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.229592085 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.229619980 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.229747057 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.229762077 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.229882002 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.256334066 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.256382942 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.256427050 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.256438971 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.256467104 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.256486893 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.268059015 CEST	80	49720	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:25.285474062 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.285500050 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.285628080 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.285645008 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.285896063 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.312165022 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.312190056 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.312254906 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.312266111 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.312304020 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.393321991 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.393352032 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.393409967 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.393419027 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.393444061 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.393464088 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.417260885 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.417282104 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.417352915 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.417368889 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.417407036 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.417429924 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.439533949 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.439563990 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.439614058 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.439621925 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.439650059 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.439668894 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.460055113 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.460076094 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.460167885 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.460175991 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.460218906 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.481168032 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.481188059 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.481251955 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.481262922 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.481555939 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.499047041 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.499066114 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.499141932 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.499150038 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.500562906 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.518554926 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.518585920 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.518635988 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.518645048 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.518665075 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.518685102 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.546173096 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.546199083 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.546251059 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.546261072 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.547746897 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.561062098 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.561089993 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.561163902 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.561172009 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.563911915 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.572272062 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.572335005 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.572344065 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.572351933 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.572393894 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.586190939 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.586215019 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.586271048 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.586277962 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.588553905 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.598680019 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.598717928 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.598753929 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.598758936 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.598781109 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.598797083 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.612128973 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.612154961 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.612246037 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.612253904 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.615890980 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.625427961 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.625452995 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.625510931 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.625518084 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.625703096 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.627335072 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.627386093 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.627393961 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.627407074 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.627440929 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.627450943 CEST	443	49721	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:25.627461910 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.627461910 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:25.627494097 CEST	49721	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.586704016 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.586796999 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.586889029 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.587202072 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.587239981 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.683576107 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:40.718101025 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.718132973 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.718214035 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.718446016 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.718456984 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.913566113 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.913655996 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.916213989 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.916218996 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.918167114 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:40.918169975 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:40.984972000 CEST	80	49724	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:40.985070944 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:40.985210896 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:41.044778109 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.044894934 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.045356035 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.045371056 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.046950102 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.046962976 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.232671976 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.232949018 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.255074978 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.255086899 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.255161047 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.255208969 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.255232096 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.255260944 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.255297899 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.277322054 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.277371883 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.277401924 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.277410030 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.277441978 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.277467966 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.277565002 CEST	49723	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.277595043 CEST	443	49723	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.286340952 CEST	80	49724	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:41.287678003 CEST	80	49724	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:41.287750959 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:41.287770033 CEST	80	49724	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:41.287811995 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:41.287832975 CEST	49724	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:41.363964081 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.364067078 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.386713028 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.386724949 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.386809111 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.386820078 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.386857986 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.386900902 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.386945963 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.413146019 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.413170099 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.413242102 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.413263083 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.413321018 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.536866903 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.536887884 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.536962986 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.536976099 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.537024021 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.567960978 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.567982912 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.568080902 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.568128109 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.571944952 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.588953972 CEST	80	49724	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:41.596982956 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.597007036 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.597088099 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.597141027 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.597174883 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.597290039 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.682847977 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.682871103 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.682948112 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.682957888 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.683007956 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.703562021 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.703584909 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.703655958 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.703665018 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.703716040 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.720715046 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.720758915 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.720799923 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.720805883 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.720859051 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.743016958 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.743038893 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.743108988 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.743118048 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.743168116 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.763567924 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.763586998 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.763669968 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.763679028 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.763725042 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.784749031 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.784766912 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.784837008 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.784845114 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.784888029 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.805826902 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.805845976 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.805922031 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.805939913 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.806000948 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.825357914 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.825377941 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.825450897 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.825481892 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.825544119 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.850621939 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.850641012 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.850722075 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.850739002 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.850796938 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.865734100 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.865752935 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.865828991 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.865844965 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.865912914 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.878901958 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.878930092 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.878983021 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.878999949 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.879029036 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.879048109 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.892874956 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.892893076 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.892981052 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.892997026 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.893059015 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.907365084 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.907385111 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.907469034 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.907504082 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.907568932 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.920396090 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.920416117 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.920475960 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.920492887 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.920535088 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.920579910 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.924319983 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.924397945 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.933945894 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.934029102 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.934042931 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:41.934061050 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.934103966 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.934233904 CEST	49725	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:41.934252977 CEST	443	49725	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.089220047 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.089253902 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.089363098 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.089627981 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.089643955 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.175235987 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.219428062 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.219480991 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.219568968 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.219821930 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.219835043 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.416481018 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.416591883 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.417073011 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.417082071 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.419306993 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.419317007 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.471229076 CEST	80	49727	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:44.471340895 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.471509933 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.545783043 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.545861959 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.546370029 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.546377897 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.547916889 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.547921896 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.735651016 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.735799074 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.758052111 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.758063078 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.758105993 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.758164883 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.758198023 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.758222103 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.758256912 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.767437935 CEST	80	49727	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:44.768740892 CEST	80	49727	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:44.768786907 CEST	80	49727	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:44.768882036 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.768930912 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.768960953 CEST	49727	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:44.780380011 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.780446053 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.780473948 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.780504942 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.780524969 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.780536890 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.780544043 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.780586958 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.780750990 CEST	49726	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.780771971 CEST	443	49726	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.888890982 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.888923883 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.888942957 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.888993025 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.889045954 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.889054060 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.889106989 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.915771961 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.915796041 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.915879011 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:44.915909052 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:44.915956974 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.037437916 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.037461042 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.037579060 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.037667990 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.037745953 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.064892054 CEST	80	49727	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:45.068602085 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.068646908 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.068708897 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.068737984 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.068754911 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.068787098 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.097630978 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.097695112 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.097812891 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.097836971 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.097875118 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.097894907 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.185935974 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.185981989 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.186038017 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.186110973 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.186152935 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.186187983 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.206415892 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.206461906 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.206516981 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.206535101 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.206592083 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.206626892 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.227006912 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.227030993 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.227163076 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.227216005 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.227293015 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.249406099 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.249430895 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.249568939 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.249644995 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.249707937 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.272933960 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.272979021 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.273060083 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.273085117 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.273143053 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.273163080 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.292973042 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.293014050 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.293118954 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.293163061 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.293231010 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.293231010 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.311283112 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.311335087 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.311433077 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.311454058 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.311482906 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.311510086 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.345136881 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.345165968 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.345252991 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.345282078 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.345326900 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.358598948 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.358644962 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.358699083 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.358726978 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.358753920 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.358762980 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.373821020 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.373867035 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.373923063 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.373946905 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.373996019 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.373996019 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.387155056 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.387203932 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.387269974 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.387285948 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.387319088 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.387339115 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.401340008 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.401384115 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.401441097 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.401448965 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.401498079 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.415940046 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.415985107 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.416054964 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.416062117 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.416090012 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.416126013 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.428913116 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.428931952 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.429014921 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.429023027 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.429069042 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.440709114 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.440753937 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.440788031 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.440804958 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.440821886 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:45.440831900 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.440849066 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.440893888 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.440999985 CEST	49728	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:45.441015005 CEST	443	49728	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.236644030 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.236690044 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.236780882 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.237035990 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.237057924 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.331954002 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:46.373971939 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.374001026 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.374083996 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.374346018 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.374358892 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.562392950 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.562508106 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.562968016 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.562982082 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.564613104 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.564625025 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.633399010 CEST	80	49730	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:46.633508921 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:46.633723021 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:46.706923962 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.707031012 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.707515001 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.707525015 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.709156036 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.709161997 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.904329062 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.904347897 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.904364109 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.904398918 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.904453039 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.904467106 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.904521942 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.926551104 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.926603079 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.926626921 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.926641941 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.926704884 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.926836014 CEST	49729	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:46.926851034 CEST	443	49729	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:46.934993982 CEST	80	49730	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:46.936234951 CEST	80	49730	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:46.936271906 CEST	80	49730	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:46.936302900 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:46.936348915 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:46.936348915 CEST	49730	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:47.047902107 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.047960997 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.048013926 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.048019886 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.048055887 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.048069000 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.048125029 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.048154116 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.074575901 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.074621916 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.074678898 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.074688911 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.074726105 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.074745893 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.196085930 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.196160078 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.196170092 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.196207047 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.196213961 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.196274042 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.227298021 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.227340937 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.227384090 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.227395058 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.227427006 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.227456093 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.237839937 CEST	80	49730	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:47.256378889 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.256422043 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.256473064 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.256481886 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.256548882 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.345402002 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.345437050 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.345541000 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.345556021 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.345606089 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.364866972 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.364923954 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.365008116 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.365017891 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.365046024 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.365063906 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.385390997 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.385421991 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.385564089 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.385575056 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.385632992 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.407716990 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.407749891 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.407865047 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.407875061 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.407922029 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.431286097 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.431328058 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.431407928 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.431416035 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.431472063 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.451395988 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.451421976 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.451520920 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.451529980 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.451576948 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.469599962 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.469624043 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.469733953 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.469743967 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.469789028 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.503701925 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.503739119 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.503827095 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.503835917 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.503880024 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.517049074 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.517083883 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.517194033 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.517205000 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.517255068 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.532372952 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.532454014 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.532485962 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.532497883 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.532522917 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.532543898 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.545558929 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.545613050 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.545667887 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.545676947 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.545720100 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.559931993 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.559957027 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.560050011 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.560060024 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.560137033 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.574285030 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.574331999 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.574390888 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.574398994 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.574449062 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.587371111 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.587439060 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.587483883 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.587491989 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.587516069 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.587785959 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.599055052 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.599103928 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.599205971 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.599214077 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.599241972 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:47.599248886 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.599292040 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.599354982 CEST	49731	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:47.599368095 CEST	443	49731	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.584255934 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.584311962 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.584480047 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.584686041 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.584702969 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.692011118 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:48.738882065 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.738976002 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.739078045 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.739326954 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.739348888 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.909399033 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.909790993 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.909948111 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.909955025 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.911626101 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:48.911632061 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:48.988032103 CEST	80	49733	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:48.988174915 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:48.988347054 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:49.064439058 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.064549923 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.065033913 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.065047026 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.066688061 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.066694021 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.228837013 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.228907108 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.251233101 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.251255035 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.251321077 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.251324892 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.251368999 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.251415968 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.251422882 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.273559093 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.273617029 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.273633957 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.273644924 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.273655891 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.273691893 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.273704052 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.273912907 CEST	49732	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.273929119 CEST	443	49732	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.284372091 CEST	80	49733	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:49.285571098 CEST	80	49733	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:49.285621881 CEST	80	49733	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:49.285635948 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:49.285700083 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:49.285700083 CEST	49733	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:49.406141996 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.406173944 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.406194925 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.406240940 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.406280041 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.406302929 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.406373024 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.433034897 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.433108091 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.433154106 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.433176041 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.433204889 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.433228016 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.555150032 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.555201054 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.555291891 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.555361986 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.555398941 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.555427074 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.581985950 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.582046032 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.582094908 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.582129955 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.582164049 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.582186937 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.582353115 CEST	80	49733	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:49.610362053 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.610411882 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.610503912 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.610519886 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.610567093 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.610589027 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.704364061 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.704415083 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.704502106 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.704533100 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.704560041 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.704590082 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.725935936 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.725966930 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.726038933 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.726105928 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.726171970 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.726171970 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.745984077 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.745997906 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.746073961 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.746092081 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.746175051 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.768316984 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.768333912 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.768421888 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.768436909 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.768486977 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.791817904 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.791832924 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.792016029 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.792035103 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.792092085 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.809154034 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.809171915 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.809259892 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.809273005 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.809324980 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.830383062 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.830405951 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.830508947 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.830532074 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.830586910 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.865171909 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.865192890 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.865437031 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.865468025 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.865545034 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.878695965 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.878711939 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.878797054 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.878813028 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.878868103 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.892256021 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.892270088 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.892354965 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.892368078 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.892419100 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.907974005 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.907989979 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.908071995 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.908087015 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.908145905 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.919992924 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.920008898 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.920080900 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.920094013 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.920145988 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.926197052 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.926269054 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.939599037 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.939615011 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.939798117 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.939817905 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.939879894 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.953690052 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.953705072 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.953775883 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.953788996 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.953840971 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.959450960 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.959546089 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.959613085 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:49.959667921 CEST	443	49734	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:49.959728003 CEST	49734	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.729919910 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.729960918 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:50.730072975 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.730350971 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.730377913 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:50.746172905 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.746205091 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:50.746293068 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.746494055 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:50.746506929 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:50.747035980 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.045797110 CEST	80	49737	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:51.045907974 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.046117067 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.056014061 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.056114912 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.059654951 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.059681892 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.059964895 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.060038090 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.060532093 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.070763111 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.070878983 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.073394060 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.073407888 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.073649883 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.073704004 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.074047089 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.108115911 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.120130062 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.345936060 CEST	80	49737	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:51.346201897 CEST	80	49737	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:51.346215963 CEST	80	49737	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:51.346272945 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.346327066 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.346380949 CEST	49737	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:51.375153065 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.375236034 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.397358894 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.397368908 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.397408962 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.397459030 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.397490978 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.397531033 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.397559881 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.412055016 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.412080050 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.412134886 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.412139893 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.412173033 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.412185907 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.412236929 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.412261009 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.419961929 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.419998884 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.420020103 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.420063972 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.420222044 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.420222998 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.420222998 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.420324087 CEST	49735	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.420363903 CEST	443	49735	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.438968897 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.439030886 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.439060926 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.439076900 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.439093113 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.439129114 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.560154915 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.560178995 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.560273886 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.560313940 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.560364008 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.591253042 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.591270924 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.591367960 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.591378927 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.591422081 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.620177984 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.620214939 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.620310068 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.620347023 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.620399952 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.645772934 CEST	80	49737	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:51.708363056 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.708380938 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.708446980 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.708460093 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.708502054 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.729082108 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.729096889 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.729173899 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.729187012 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.729231119 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.749713898 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.749728918 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.749790907 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.749800920 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.749844074 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.771986008 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.772000074 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.772059917 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.772072077 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.772121906 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.795389891 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.795403957 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.795468092 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.795483112 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.795525074 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.815488100 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.815504074 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.815578938 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.815593004 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.815639973 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.833828926 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.833848953 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.833966017 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.833976030 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.834014893 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.868654013 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.868685007 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.868813992 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.868865967 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.868921995 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.882081032 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.882107019 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.882204056 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.882236958 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.882287979 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.897118092 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.897136927 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.897248983 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.897258997 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.897303104 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.912645102 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.912666082 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.912771940 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.912781000 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.912823915 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.926532030 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.926548004 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.926615000 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.926624060 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.926682949 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.939052105 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.939068079 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.939244986 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.939254999 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.939312935 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.952121973 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.952136993 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.952210903 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.952220917 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.952266932 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.963737965 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.963809967 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.963810921 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:51.963871956 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.963963032 CEST	49736	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:51.963979959 CEST	443	49736	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.254195929 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.254256964 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.254374981 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.254693031 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.254708052 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.351520061 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.351563931 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.351643085 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.351747990 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.351973057 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.351994991 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.578171968 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.578238010 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.578716993 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.578722954 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.581254959 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.581260920 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.652853966 CEST	80	49739	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:52.652946949 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.653126001 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.676510096 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.676594019 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.677052021 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.677083015 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.678637028 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.678649902 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.920046091 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.920068979 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.920137882 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.920178890 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.920188904 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.920239925 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.944540977 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.944602966 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.944633961 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.944660902 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.944691896 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.944987059 CEST	49738	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:52.945002079 CEST	443	49738	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.954323053 CEST	80	49739	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:52.955482006 CEST	80	49739	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:52.955533028 CEST	80	49739	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:52.955547094 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.955588102 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.955596924 CEST	49739	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:52.996617079 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:52.996757984 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.018940926 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.018954039 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.019021988 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.019048929 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.019117117 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.019153118 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.019196033 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.045655966 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.045674086 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.045752048 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.045773029 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.045833111 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.169667959 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.169697046 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.169812918 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.169840097 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.169909000 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.200758934 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.200776100 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.200864077 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.200882912 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.200938940 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.229746103 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.229767084 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.229854107 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.229870081 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.229959965 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.256870985 CEST	80	49739	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:53.315720081 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.315742970 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.315812111 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.315834045 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.315862894 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.315892935 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.336401939 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.336421967 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.336491108 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.336509943 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.336553097 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.357100010 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.357125998 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.357181072 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.357189894 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.357223034 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.357250929 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.379323006 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.379345894 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.379398108 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.379411936 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.379440069 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.379461050 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.403286934 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.403309107 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.403383970 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.403399944 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.403458118 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.423753023 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.423777103 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.423850060 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.423865080 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.423919916 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.441929102 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.441950083 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.442022085 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.442037106 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.442087889 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.461400032 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.461421013 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.461503029 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.461518049 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.461571932 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.485905886 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.485929012 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.485980988 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.485995054 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.486021996 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.486058950 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.500780106 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.500794888 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.500861883 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.500883102 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.500931978 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.516235113 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.516251087 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.516315937 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.516330004 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.516382933 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.529984951 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.529999018 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.530061960 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.530076027 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.530143023 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.542457104 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.542470932 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.542537928 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.542551041 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.542612076 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.555475950 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.555495024 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.555572033 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.555586100 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.555633068 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.566981077 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.567051888 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.567059040 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.567086935 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.567097902 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.567147970 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.567224979 CEST	49740	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.567251921 CEST	443	49740	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.815633059 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.815725088 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.815845013 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.816051960 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.816085100 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.896892071 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.896933079 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.897088051 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.897212029 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:53.897224903 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:53.897783995 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.139806032 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.139904022 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.140383959 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.140407085 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.141995907 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.142020941 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.199733019 CEST	80	49743	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:54.199841022 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.199969053 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.226222992 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.226305008 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.226749897 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.226758957 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.228267908 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.228281975 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.481882095 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.481911898 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.481967926 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.482007980 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.482048988 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.482081890 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.482146025 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.501097918 CEST	80	49743	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:54.503149033 CEST	80	49743	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:54.503170013 CEST	80	49743	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:54.503216982 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.503235102 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.503305912 CEST	49743	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:54.504153013 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.504205942 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.504251003 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.504275084 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.504290104 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.504292965 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.504314899 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.504358053 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.504440069 CEST	49741	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.504455090 CEST	443	49741	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.545134068 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.545248032 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.567763090 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.567778111 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.567792892 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.567884922 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.567886114 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.567894936 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.567960024 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.593673944 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.593700886 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.593780994 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.593796015 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.593841076 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.718077898 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.718105078 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.718170881 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.718182087 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.718225956 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.718225956 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.749314070 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.749330044 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.749420881 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.749428988 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.749603987 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.778237104 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.778251886 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.778309107 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.778317928 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.778369904 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.804881096 CEST	80	49743	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:54.864322901 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.864357948 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.864495039 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.864516020 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.864569902 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.885044098 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.885057926 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.885190964 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.885205030 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.885251999 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.905865908 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.905880928 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.905947924 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.905953884 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.906022072 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.928122997 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.928138971 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.928258896 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.928266048 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.928404093 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.952147007 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.952167034 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.952296019 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.952301979 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.952357054 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.972650051 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.972665071 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.972824097 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.972830057 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.972930908 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.984772921 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.984812975 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.984842062 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.984847069 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:54.984879971 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:54.984915972 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.004544973 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.004561901 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.004654884 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.004662037 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.004720926 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.032264948 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.032286882 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.032398939 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.032406092 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.032490015 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.047245026 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.047264099 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.047314882 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.047319889 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.047410011 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.060445070 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.060461044 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.060544968 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.060550928 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.060611010 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.074472904 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.074500084 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.074588060 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.074594975 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.074650049 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.087136984 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.087157965 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.087219954 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.087225914 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.087265968 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.100281000 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.100296974 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.100357056 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.100363016 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.100402117 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.113814116 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.113828897 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.113894939 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.113902092 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.113948107 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.115712881 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.115767002 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.115772009 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.115782022 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.115817070 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.115823984 CEST	443	49742	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.115833044 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.115854025 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.115864992 CEST	49742	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.366496086 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.366538048 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.366646051 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.366869926 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.366887093 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.459366083 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.459398985 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.459491014 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.459716082 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.459732056 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.459940910 CEST	49746	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:55.691210032 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.691293955 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.691823006 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.691833973 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.693444967 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.693454981 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.761858940 CEST	80	49746	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:55.761955023 CEST	49746	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:55.762123108 CEST	49746	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:55.784676075 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.784744024 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.785182953 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.785190105 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:55.786742926 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:55.786747932 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.012315035 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.012439013 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.034394979 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.034406900 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.034439087 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.034606934 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.034621000 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.034737110 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.056719065 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.056757927 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.056833982 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.056873083 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.056907892 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.057218075 CEST	49744	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.057239056 CEST	443	49744	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.063436031 CEST	80	49746	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:56.064827919 CEST	80	49746	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:56.064841986 CEST	80	49746	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:56.064894915 CEST	49746	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:56.064958096 CEST	49746	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:56.105263948 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.105418921 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.127578974 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.127588034 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.127665997 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.127768040 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.127803087 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.127871990 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.127871990 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.154454947 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.154470921 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.154544115 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.154556990 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.154625893 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.279391050 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.279428959 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.279516935 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.279529095 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.279752016 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.310555935 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.310573101 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.310637951 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.310647011 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.310761929 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.339564085 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.339587927 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.339679956 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.339689970 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.339737892 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.366246939 CEST	80	49746	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:56.424253941 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.424302101 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.424398899 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.424417973 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.424436092 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.424462080 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.446243048 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.446261883 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.446371078 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.446378946 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.446422100 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.468219995 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.468239069 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.468321085 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.468333960 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.468425035 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.490278959 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.490298033 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.490394115 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.490405083 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.490458012 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.514770031 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.514842987 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.514854908 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.514867067 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.514965057 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.534993887 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.535017967 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.535101891 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.535101891 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.535116911 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.535271883 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.552580118 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.552598000 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.552769899 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.552793980 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.552850962 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.574489117 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.574520111 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.574599981 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.574599981 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.574609995 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.574692965 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.594320059 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.594336033 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.594445944 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.594451904 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.594573975 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.609164953 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.609179020 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.609373093 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.609379053 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.609474897 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.624635935 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.624650955 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.624718904 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.624726057 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.624818087 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.638554096 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.638569117 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.638638020 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.638644934 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.638698101 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.652039051 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.652054071 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.652134895 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.652142048 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.652245998 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.664314032 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.664329052 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.664395094 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.664402008 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.664477110 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.676080942 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.676184893 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.676208019 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.676217079 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.676229000 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.676254988 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.676296949 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.676373005 CEST	49745	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.676384926 CEST	443	49745	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.928522110 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.928601980 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:56.928706884 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.928985119 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:56.929033041 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.025340080 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.025608063 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.025670052 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.025757074 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.025970936 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.025986910 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.254549980 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.254640102 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.255108118 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.255136013 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.257251978 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.257267952 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.323930025 CEST	80	49748	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:57.324009895 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.324212074 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.350383043 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.350447893 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.350872993 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.350884914 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.352729082 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.352735043 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.596769094 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.596798897 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.596826077 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.596853971 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.596899986 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.596926928 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.596992016 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.621222973 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.621289015 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.621314049 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.621334076 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.621356010 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.621385098 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.621546030 CEST	49747	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.621573925 CEST	443	49747	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.622694969 CEST	80	49748	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:57.624238968 CEST	80	49748	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:57.624289036 CEST	80	49748	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:57.624291897 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.624330997 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.624353886 CEST	49748	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:57.670052052 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.670140982 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.692574024 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.692583084 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.692692041 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.692712069 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.692769051 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.719569921 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.719588995 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.719664097 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.719676018 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.719718933 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.843213081 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.843241930 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.843334913 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.843353033 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.843399048 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.874589920 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.874619007 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.874701023 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.874733925 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.874753952 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.874778986 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.903939962 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.903968096 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.904046059 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.904078960 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.904108047 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.904125929 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.922921896 CEST	80	49748	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:57.989298105 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.989316940 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.989399910 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:57.989413023 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:57.989456892 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.010224104 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.010242939 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.010301113 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.010310888 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.010349035 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.031212091 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.031275034 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.031352043 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.031366110 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.031398058 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.031415939 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.054263115 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.054317951 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.057847977 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.057847977 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.057861090 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.057924032 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.078200102 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.078249931 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.078325033 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.078346014 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.078363895 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.078387976 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.098088980 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.098151922 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.098176003 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.098191023 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.098211050 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.098227978 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.116075993 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.116136074 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.116153002 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.116166115 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.116192102 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.116209984 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.135607958 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.135626078 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.135693073 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.135705948 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.135746002 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.159358978 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.159373045 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.159446001 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.159456968 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.159497976 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.174187899 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.174202919 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.174269915 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.174278975 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.174319983 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.187612057 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.187627077 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.187716007 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.187747002 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.187793016 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.202503920 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.202521086 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.202600002 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.202613115 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.202655077 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.216212988 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.216228008 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.216305017 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.216312885 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.216355085 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.229167938 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.229182959 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.229273081 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.229280949 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.229324102 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.240951061 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.241014004 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.241019964 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.241034031 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.241080046 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.241276979 CEST	49749	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.241295099 CEST	443	49749	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.514298916 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.514379025 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.514506102 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.514746904 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.514780045 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.602185965 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:58.602787971 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.602878094 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.602987051 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.603266001 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.603317976 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.840919971 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.841006994 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.841541052 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.841551065 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.843113899 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.843121052 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.903661013 CEST	80	49751	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:58.903811932 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:58.903953075 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:58.927053928 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.927176952 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.927709103 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.927736044 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:58.929882050 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:58.929894924 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.160161018 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.160240889 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.182327986 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.182339907 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.182370901 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.182410002 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.182440996 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.182468891 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.182502031 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.204772949 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.204802036 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.204855919 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.204874992 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.204921007 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.204921007 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.205025911 CEST	49750	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.205064058 CEST	443	49750	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.205539942 CEST	80	49751	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:59.206928968 CEST	80	49751	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:59.206976891 CEST	80	49751	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:59.207031012 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:59.207031012 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:59.207031012 CEST	49751	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:32:59.269402981 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.269418955 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.269435883 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.269468069 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.269484997 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.269504070 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.269541025 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.296134949 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.296153069 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.296225071 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.296258926 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.296339035 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.418484926 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.418508053 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.418622971 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.418685913 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.418756008 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.449676991 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.449692965 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.449769020 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.449786901 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.449851036 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.478804111 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.478827000 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.478902102 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.478923082 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.479027987 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.508446932 CEST	80	49751	52.213.137.28	192.168.2.16
Apr 24, 2024 14:32:59.566873074 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.566894054 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.566987991 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.567049026 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.567142010 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.587626934 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.587641954 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.587733030 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.587755919 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.587888002 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.608489037 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.608505964 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.608589888 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.608604908 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.608666897 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.630620003 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.630635023 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.630712032 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.630731106 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.630790949 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.656311989 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.656327963 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.656430960 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.656446934 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.656522989 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.674536943 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.674551964 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.674621105 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.674640894 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.674737930 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.692755938 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.692770958 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.692858934 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.692873955 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.692935944 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.726248026 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.726262093 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.726346970 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.726372004 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.726427078 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.739692926 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.739707947 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.739764929 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.739775896 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.739821911 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.754895926 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.754910946 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.754972935 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.754983902 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.755152941 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.770519018 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.770536900 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.770600080 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.770607948 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.770651102 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.784707069 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.784720898 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.784785032 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.784795046 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.785013914 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.797003031 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.797017097 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.797097921 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.797106028 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.797156096 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.810293913 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.810309887 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.810385942 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.810395002 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.810472012 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.821885109 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.821927071 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.821973085 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.821974993 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:32:59.822006941 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.822046995 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.822215080 CEST	49752	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:32:59.822231054 CEST	443	49752	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.077421904 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.077505112 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.077626944 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.077819109 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.077852964 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.165334940 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.165374994 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.165477991 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.165671110 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.165688038 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.166035891 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.410271883 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.410346031 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.410799980 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.410809994 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.412404060 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.412412882 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.464595079 CEST	80	49755	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:00.464703083 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.464844942 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.496473074 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.496555090 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.497014046 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.497024059 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.498569965 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.498573065 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.729080915 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.729171038 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.751766920 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.751782894 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.751831055 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.751861095 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.751882076 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.751909971 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.751933098 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.763232946 CEST	80	49755	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:00.764537096 CEST	80	49755	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:00.764553070 CEST	80	49755	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:00.764606953 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.764678001 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.764678955 CEST	49755	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:00.774171114 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.774207115 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.774235010 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.774276018 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.774283886 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.774313927 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.774333954 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.774434090 CEST	49753	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.774450064 CEST	443	49753	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838264942 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838344097 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838361979 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.838372946 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838387966 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838413954 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.838421106 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.838442087 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.838464022 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.865175962 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.865225077 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.865271091 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.865281105 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.865308046 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.865326881 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.986974955 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.987010956 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.987060070 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.987071037 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:00.987091064 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:00.987128019 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.019808054 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.019841909 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.019886971 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.019893885 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.019917965 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.019939899 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.046516895 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.046559095 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.046607971 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.046613932 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.046664953 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.065515041 CEST	80	49755	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:01.134752035 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.134855986 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.134871960 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.134882927 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.134918928 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.134936094 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.155272961 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.155296087 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.155338049 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.155342102 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.155360937 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.155385017 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.175832033 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.175853014 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.175899029 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.175904036 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.175924063 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.175944090 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.198383093 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.198405027 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.198448896 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.198453903 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.198471069 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.198494911 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.221653938 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.221692085 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.221750021 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.221755028 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.221781015 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.221793890 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.242182016 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.242213964 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.242264032 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.242268085 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.242290020 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.242310047 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.260667086 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.260698080 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.260739088 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.260744095 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.260765076 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.260787964 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.293998003 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.294028044 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.294075966 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.294080973 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.294118881 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.294142008 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.307332039 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.307353973 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.307399035 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.307404041 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.307425976 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.307446957 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.322521925 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.322544098 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.322593927 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.322598934 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.322618961 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.322640896 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.338035107 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.338056087 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.338115931 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.338119984 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.338141918 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.338165045 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.352001905 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.352024078 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.352071047 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.352076054 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.352093935 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.352128029 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.365341902 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.365364075 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.365459919 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.365464926 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.365504026 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.377587080 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.377614975 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.377655983 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.377660036 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.377753019 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389189005 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.389228106 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.389271021 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389276028 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.389288902 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.389297009 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389319897 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389344931 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389410019 CEST	49754	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.389425039 CEST	443	49754	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.641309977 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.641340017 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.641436100 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.641654968 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.641670942 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.739897013 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.739927053 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.740022898 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.740256071 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.740268946 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.740886927 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:01.967133999 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.967214108 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.967668056 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.967674017 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:01.969286919 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:01.969293118 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.039366007 CEST	80	49758	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:02.039510965 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:02.039683104 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:02.067259073 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.067341089 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.067816973 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.067830086 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.069406986 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.069415092 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.288228035 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.288310051 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.310501099 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.310513020 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.310549974 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.310583115 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.310609102 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.310628891 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.310656071 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.333054066 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.333086967 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.333141088 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.333148956 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.333173037 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.333195925 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.333364010 CEST	49756	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.333379030 CEST	443	49756	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.338104963 CEST	80	49758	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:02.339324951 CEST	80	49758	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:02.339373112 CEST	80	49758	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:02.339378119 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:02.339410067 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:02.339427948 CEST	49758	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:02.388044119 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.388514996 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.410614967 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.410631895 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.410667896 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.416122913 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.424118996 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.424118996 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.424118996 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.424155951 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.424217939 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.437378883 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.437406063 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.437460899 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.437484980 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.437500954 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.437522888 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.560832977 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.560857058 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.560925007 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.560966015 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.560985088 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.561022997 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.594479084 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.594501972 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.594600916 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.594616890 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.594660997 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.623944998 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.623966932 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.624063969 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.624075890 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.624135017 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.639462948 CEST	80	49758	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:02.708579063 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.708615065 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.708715916 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.708730936 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.708775043 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.729217052 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.729238033 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.729386091 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.729387045 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.729423046 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.729477882 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.746530056 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.746572018 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.746612072 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.746623993 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.746651888 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.746665001 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.769125938 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.769146919 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.769217014 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.769228935 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.769275904 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.792840958 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.792860031 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.792931080 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.792944908 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.792999983 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.813823938 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.813843966 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.813988924 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.813990116 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.814029932 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.814090967 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.831921101 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.831938982 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.832101107 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.832134008 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.832200050 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.851490021 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.851509094 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.851650953 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.851650953 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.851682901 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.851748943 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.876578093 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.876597881 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.876648903 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.876660109 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.876678944 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.876847982 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.891855001 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.891875029 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.892086029 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.892123938 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.892184973 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.907356977 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.907377958 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.907455921 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.907468081 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.907512903 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.921528101 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.921550989 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.921636105 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.921647072 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.921698093 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.934076071 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.934096098 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.934164047 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.934175014 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.934221029 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.947365046 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.947386026 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.947449923 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.947459936 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.947510004 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.951100111 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.951167107 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961086035 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.961113930 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.961159945 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961170912 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.961201906 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961201906 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:02.961225033 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961237907 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961313963 CEST	49757	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:02.961328983 CEST	443	49757	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.220276117 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.220304012 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.220417976 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.220628023 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.220638037 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.310925007 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.311155081 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.311197042 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.311276913 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.311497927 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.311512947 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.551101923 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.551192999 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.551672935 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.551683903 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.553303003 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.553308964 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.609662056 CEST	80	49760	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:03.609778881 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.609971046 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.641565084 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.641638041 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.642205000 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.642218113 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.644082069 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.644087076 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.892956972 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.892990112 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.893012047 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.893048048 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.893083096 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.893096924 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.893152952 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.908854961 CEST	80	49760	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:03.910289049 CEST	80	49760	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:03.910322905 CEST	80	49760	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:03.910363913 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.910413980 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.910413980 CEST	49760	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:03.917448044 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.917507887 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.917572975 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.917582989 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.917623997 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.917633057 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.917686939 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.917860985 CEST	49759	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.917872906 CEST	443	49759	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.961627960 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.961730957 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.983800888 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.983814001 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.983856916 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.983917952 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:03.983925104 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:03.983973026 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.010607004 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.010637045 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.010735035 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.010744095 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.010790110 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.134540081 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.134603977 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.134665966 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.134680033 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.134727955 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.165415049 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.165460110 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.165534973 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.165543079 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.165605068 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.194433928 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.194495916 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.194545984 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.194555044 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.194586992 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.194610119 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.209220886 CEST	80	49760	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:04.280543089 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.280597925 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.280664921 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.280698061 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.280754089 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.301110983 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.301155090 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.301211119 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.301223993 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.301279068 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.318259954 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.318294048 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.318351984 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.318356991 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.318408012 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.340620041 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.340667009 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.340722084 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.340744019 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.340764046 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.340787888 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.364562035 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.364607096 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.364662886 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.364670038 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.364713907 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.382395029 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.382425070 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.382518053 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.382524967 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.382570028 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.403583050 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.403615952 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.403738022 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.403748989 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.403793097 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.422909021 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.422930956 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.423029900 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.423038006 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.423073053 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.448201895 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.448246956 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.448296070 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.448302031 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.448333025 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.448353052 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.463161945 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.463181973 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.463272095 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.463279009 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.463320971 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.478560925 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.478579998 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.478662968 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.478668928 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.478708029 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.490314007 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.490334988 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.490400076 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.490405083 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.490447998 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.504868031 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.504897118 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.504971981 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.504977942 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.505021095 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.517878056 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.517899036 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.517960072 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.517966032 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.518008947 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.529613972 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.529634953 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.529697895 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.529702902 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.529743910 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531538010 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.531599045 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531603098 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.531644106 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531673908 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531685114 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.531708956 CEST	443	49761	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.531723022 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531737089 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.531758070 CEST	49761	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.786855936 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.786916971 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.787029982 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.787277937 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.787300110 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.869587898 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:04.870086908 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.870112896 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:04.870186090 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.870400906 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:04.870413065 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.113909006 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.113987923 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.114437103 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.114442110 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.116064072 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.116067886 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.165443897 CEST	80	49763	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:05.165570021 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:05.165708065 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:05.195444107 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.195538044 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.196145058 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.196154118 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.198304892 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.198308945 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.457334995 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.457406044 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.457448006 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.457463980 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.457485914 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.457493067 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.457541943 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.461507082 CEST	80	49763	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:05.462912083 CEST	80	49763	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:05.463000059 CEST	80	49763	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:05.463000059 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:05.463042021 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:05.463072062 CEST	49763	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:05.480353117 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.480427980 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.480496883 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.480510950 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.480537891 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.480551958 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.480608940 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.480654001 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.480753899 CEST	49762	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.480765104 CEST	443	49762	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537714958 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537789106 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537817001 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.537832022 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537846088 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.537853003 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537882090 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.537888050 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.537919998 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.537939072 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.564213991 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.564263105 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.564291954 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.564305067 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.564325094 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.564342022 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.677040100 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.677082062 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.677191019 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.677205086 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.677234888 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.677252054 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.708062887 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.708084106 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.708188057 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.708195925 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.708246946 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.737390995 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.737432957 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.737471104 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.737477064 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.737515926 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.758788109 CEST	80	49763	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:05.764139891 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.764195919 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.764238119 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.764249086 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.764276981 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.764295101 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.847918034 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.847976923 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.848010063 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.848020077 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.848058939 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.871881008 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.871926069 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.871956110 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.871962070 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.871983051 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.871998072 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.894133091 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.894175053 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.894211054 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.894217014 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.894242048 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.894260883 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.914402008 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.914422989 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.914469004 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.914474010 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.914495945 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.914515018 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.935127020 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.935148001 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.935203075 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.935209036 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.935246944 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.953408957 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.953448057 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.953480959 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.953485012 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.953507900 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.953526020 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.973058939 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.973086119 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.973175049 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:05.973181963 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:05.973222017 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.004386902 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.004409075 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.004492044 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.004501104 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.004535913 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.017471075 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.017492056 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.017549992 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.017556906 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.017595053 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.033162117 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.033185005 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.033278942 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.033287048 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.033320904 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.047214031 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.047233105 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.047310114 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.047316074 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.047353983 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.059765100 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.059792995 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.059880972 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.059890032 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.059926033 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.063745022 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.063815117 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.076906919 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.076926947 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.077049971 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.077058077 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.077105999 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.088581085 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.088628054 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.088656902 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.088661909 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.088692904 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.088707924 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.089452982 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.089503050 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.089534044 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.089591980 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.089597940 CEST	443	49764	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.089613914 CEST	49764	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.362555981 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.362601995 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.362716913 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.363125086 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.363140106 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.452169895 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:06.452512980 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.452549934 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.452642918 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.452841043 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.452851057 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.688307047 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.689038038 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.689038038 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.689059019 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.692151070 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.692157984 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.748255014 CEST	80	49766	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:06.748409986 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:06.748646021 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:06.779117107 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.779210091 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.779689074 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.779695034 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:06.781378031 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:06.781380892 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.029433012 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.029459000 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.029475927 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.029577971 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.029685020 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.029692888 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.029753923 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.044576883 CEST	80	49766	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:07.045972109 CEST	80	49766	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:07.046006918 CEST	80	49766	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:07.046034098 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:07.046088934 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:07.046088934 CEST	49766	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:07.053996086 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.054040909 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.054075003 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.054142952 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.054142952 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.054250956 CEST	49765	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.054261923 CEST	443	49765	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.121965885 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.121997118 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.122016907 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.122042894 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.122081995 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.122087955 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.122139931 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.148608923 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.148631096 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.148700953 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.148708105 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.148749113 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.270062923 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.270096064 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.270196915 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.270220995 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.270267010 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.301358938 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.301389933 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.301440001 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.301491022 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.301498890 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.301554918 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.330256939 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.330292940 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.330343962 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.330362082 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.330380917 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.330399036 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.342015028 CEST	80	49766	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:07.418711901 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.418775082 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.418952942 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.418952942 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.418982983 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.419034004 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.439095974 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.439120054 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.439198971 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.439209938 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.439248085 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.459686041 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.459707975 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.459769011 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.459774971 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.459841013 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.482213974 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.482259989 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.482300043 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.482310057 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.482332945 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.482348919 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.505491972 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.505551100 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.505580902 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.505588055 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.505614042 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.505635023 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.525494099 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.525515079 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.525603056 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.525612116 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.525655985 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.543709993 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.543732882 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.543788910 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.543797016 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.543823957 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.543850899 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.577923059 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.577965975 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.578001022 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.578006983 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.578033924 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.578057051 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.591298103 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.591341019 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.591370106 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.591379881 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.591402054 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.591424942 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.606520891 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.606563091 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.606595039 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.606601000 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.606626034 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.606647968 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.622097015 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.622139931 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.622176886 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.622193098 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.622205019 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.622229099 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.636033058 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.636050940 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.636142015 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.636148930 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.636198997 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.651721001 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.651748896 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.651825905 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.651839972 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.651866913 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.651882887 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.662772894 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.662820101 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.662859917 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.662883997 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.662898064 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.662934065 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674292088 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.674352884 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.674387932 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674396038 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.674422026 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674482107 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674487114 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.674526930 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674561977 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.674604893 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674643040 CEST	49767	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.674658060 CEST	443	49767	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.919509888 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.919558048 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:07.919662952 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.919873953 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:07.919888020 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.015080929 CEST	49769	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:08.015377998 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.015429974 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.015527010 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.015734911 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.015769005 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.251672983 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.251785994 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.252233028 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.252245903 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.253876925 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.253880024 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.311177969 CEST	80	49769	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:08.311278105 CEST	49769	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:08.311486959 CEST	49769	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:08.340488911 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.340549946 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.340987921 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.340998888 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.342614889 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.342621088 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.593535900 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.593569994 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.593595982 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.593605995 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.593622923 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.593646049 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.593688011 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.607547045 CEST	80	49769	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:08.609319925 CEST	80	49769	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:08.609389067 CEST	49769	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:08.609397888 CEST	80	49769	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:08.609462023 CEST	49769	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:08.618021965 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.618078947 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.618124962 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.618160963 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.618200064 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.618386984 CEST	49768	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.618402958 CEST	443	49768	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.660075903 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.660188913 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.682979107 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.682995081 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.683034897 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.683082104 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.683104992 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.683160067 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.709886074 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.709916115 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.710052013 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.710074902 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.710128069 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.832961082 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.832994938 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.833106041 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.833173990 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.833246946 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.864095926 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.864166021 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.864213943 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.864236116 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.864268064 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.864289999 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.893141985 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.893188953 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.893224955 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.893239975 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.893265963 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.893285990 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.905469894 CEST	80	49769	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:08.979398966 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.979427099 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.979518890 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.979546070 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.979588985 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.999799013 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.999914885 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:08.999933004 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:08.999998093 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.020262003 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.020291090 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.020390034 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.020401001 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.020452023 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.042423010 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.042443037 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.042505980 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.042511940 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.042561054 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.066425085 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.066459894 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.066514015 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.066549063 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.066566944 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.066598892 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.086582899 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.086617947 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.086673975 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.086684942 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.086714029 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.086736917 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.104554892 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.104583979 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.104667902 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.104681015 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.104726076 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.123917103 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.123951912 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.124020100 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.124037981 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.124064922 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.124118090 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.149456978 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.149482965 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.149594069 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.149611950 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.149666071 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.164524078 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.164549112 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.164601088 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.164634943 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.164658070 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.164694071 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.179785967 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.179811001 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.179891109 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.179924965 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.179955959 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.179984093 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.193582058 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.193614960 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.193659067 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.193670034 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.193685055 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.193710089 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.205969095 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.205993891 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.206085920 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.206095934 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.206147909 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.218900919 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.218924999 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.219029903 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.219046116 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.219109058 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230438948 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.230473995 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.230531931 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230545998 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.230575085 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.230575085 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230602980 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230624914 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230732918 CEST	49770	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.230765104 CEST	443	49770	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.486674070 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.486720085 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.487062931 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.487062931 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.487093925 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.576922894 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:09.577240944 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.577274084 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.577374935 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.577574968 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.577588081 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.811851978 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.811958075 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.812436104 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.812442064 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.814063072 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.814066887 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.875657082 CEST	80	49772	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:09.875798941 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:09.875869989 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:09.901869059 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.901935101 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.902379990 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.902388096 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:09.903857946 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:09.903862953 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.131978035 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.132066011 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.154289961 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.154305935 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.154326916 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.154369116 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.154411077 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.154442072 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.154457092 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.154483080 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.154519081 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.174491882 CEST	80	49772	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:10.176021099 CEST	80	49772	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:10.176107883 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:10.176135063 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:10.176146984 CEST	80	49772	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:10.176265001 CEST	49772	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:10.176623106 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.176672935 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.176706076 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.176722050 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.176748991 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.176760912 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.176770926 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.176804066 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.176974058 CEST	49771	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.177005053 CEST	443	49771	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.221084118 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.221143961 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.243376970 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.243386030 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.243411064 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.243443012 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.243453026 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.243499041 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.270287037 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.270313025 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.270411015 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.270418882 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.270452976 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.393923998 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.393985033 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.394040108 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.394056082 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.394084930 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.394117117 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.420671940 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.420713902 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.420795918 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.420814037 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.420825005 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.420845032 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.449728966 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.449779987 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.449884892 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.449898958 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.449911118 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.449942112 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.474701881 CEST	80	49772	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:10.539952040 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.540019989 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.540117979 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.540136099 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.540164948 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.540186882 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.560825109 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.560870886 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.560926914 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.560941935 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.560961962 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.560981989 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.578128099 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.578172922 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.578221083 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.578237057 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.578253031 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.578273058 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.600826025 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.600868940 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.600898981 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.600914001 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.600940943 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.600956917 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.624608040 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.624651909 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.624684095 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.624701977 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.624717951 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.624742031 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.645442009 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.645487070 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.645522118 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.645528078 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.645551920 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.645574093 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.660505056 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.660553932 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.660588980 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.660594940 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.660620928 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.660639048 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.679940939 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.679985046 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.680022001 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.680028915 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.680053949 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.680073023 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.707505941 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.707550049 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.707591057 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.707600117 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.707623959 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.707648039 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.722362041 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.722424984 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.722446918 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.722455025 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.722482920 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.722501993 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.735774040 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.735816002 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.735863924 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.735872030 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.735897064 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.735914946 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.747781038 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.747823954 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.747870922 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.747879028 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.747906923 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.747915983 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.760293961 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.760334015 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.760370970 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.760376930 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.760401011 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.760417938 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.773993015 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.774039030 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.774106026 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.774116993 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.774163961 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.787549973 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.787599087 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.787631035 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.787636995 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.787662029 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.787686110 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.787689924 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.787724018 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.791433096 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.791498899 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.791503906 CEST	443	49773	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:10.791543007 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.791552067 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:10.791584969 CEST	49773	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.040329933 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.040368080 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.040478945 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.040689945 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.040704966 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.124605894 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.125055075 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.125093937 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.125202894 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.125581026 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.125593901 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.371961117 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.372040033 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.372519970 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.372530937 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.374509096 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.374515057 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.424765110 CEST	80	49775	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:11.424892902 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.425098896 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.458342075 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.458446980 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.458930969 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.458940983 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.460566998 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.460572004 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.713733912 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.713800907 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.713838100 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.713846922 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.713875055 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.713890076 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.713927984 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.723562002 CEST	80	49775	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:11.725064993 CEST	80	49775	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:11.725109100 CEST	80	49775	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:11.725142002 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.725172997 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.725218058 CEST	49775	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:11.740570068 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.740639925 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.740684986 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.740691900 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.740721941 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.740736008 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.741044044 CEST	49774	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.741064072 CEST	443	49774	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.801084995 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.801148891 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.801192045 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.801199913 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.801199913 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.801222086 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.801259995 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.801273108 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.826195002 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.826241016 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.826292038 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.826307058 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.826332092 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.826380014 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.948642969 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.948688030 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.948775053 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.948775053 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.948785067 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.948826075 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.979861975 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.979909897 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.979948044 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:11.979954004 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:11.980112076 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.008820057 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.008886099 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.008933067 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.008933067 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.008939981 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.008981943 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.023669004 CEST	80	49775	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:12.098784924 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.098817110 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.098881960 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.098891020 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.098938942 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.098938942 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.119617939 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.119678020 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.119781971 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.119796991 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.119839907 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.119839907 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.140542984 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.140599012 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.140647888 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.140661001 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.140691996 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.140691996 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.163026094 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.163090944 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.163160086 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.163182020 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.163218021 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.163218021 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.186578035 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.186621904 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.186685085 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.186685085 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.186691999 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.186775923 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.206595898 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.206639051 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.206712008 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.206712008 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.206728935 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.206765890 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.225120068 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.225161076 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.225202084 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.225213051 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.225235939 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.225275040 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.258357048 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.258403063 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.258456945 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.258465052 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.258497000 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.258508921 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.271727085 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.271770000 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.271838903 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.271838903 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.271846056 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.271919012 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.287178040 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.287199020 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.287260056 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.287267923 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.287307978 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.302911997 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.302927971 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.303078890 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.303086042 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.303132057 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.317033052 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.317048073 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.317120075 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.317138910 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.317193031 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.329703093 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.329718113 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.329782009 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.329792976 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.329879045 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.343182087 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.343197107 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.343281031 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.343286991 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.343328953 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.354942083 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.354979038 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.355017900 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.355041981 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.355041981 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.355068922 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.355134010 CEST	49776	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.355145931 CEST	443	49776	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.631617069 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.631658077 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.631747961 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.631958961 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.631970882 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.723784924 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:12.724123955 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.724153042 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.724253893 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.724438906 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.724452019 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.968450069 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.968566895 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.969016075 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.969024897 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:12.970576048 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:12.970583916 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.022713900 CEST	80	49778	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:13.022803068 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:13.022943974 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:13.050976038 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.051063061 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.051506996 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.051513910 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.053057909 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.053061962 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.289911032 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.290039062 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.312206030 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.312231064 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.312273026 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.312309027 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.312324047 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.312372923 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.312372923 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.318624020 CEST	80	49778	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:13.320030928 CEST	80	49778	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:13.320045948 CEST	80	49778	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:13.320111990 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:13.320138931 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:13.320138931 CEST	49778	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:13.334439993 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.334490061 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.334523916 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.334536076 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.334583998 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.334583998 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.334615946 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.334742069 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.334742069 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.392327070 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.392352104 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.392366886 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.392410994 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.392438889 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.392462969 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.392534018 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.418931961 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.418950081 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.419050932 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.419050932 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.419075012 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.419128895 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.540538073 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.540558100 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.540642023 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.540668011 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.540715933 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.571743965 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.571762085 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.571891069 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.571907043 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.571954966 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.600689888 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.600711107 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.600852013 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.600868940 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.600927114 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.615971088 CEST	80	49778	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:13.650194883 CEST	49777	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.650209904 CEST	443	49777	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.688898087 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.688920975 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.689002991 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.689024925 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.689109087 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.709583044 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.709608078 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.709657907 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.709671021 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.709696054 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.709718943 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.730118036 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.730133057 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.730201960 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.730215073 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.730257034 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.752494097 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.752562046 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.752592087 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.752602100 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.752625942 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.752645969 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.775847912 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.775873899 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.775930882 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.775947094 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.775964022 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.775986910 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.795897961 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.795918941 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.796019077 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.796037912 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.796082020 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.814256907 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.814275980 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.814340115 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.814352036 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.814393997 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.848301888 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.848321915 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.848411083 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.848438025 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.848490953 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.861700058 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.861716032 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.861799002 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.861809015 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.861856937 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.877019882 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.877043009 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.877142906 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.877161026 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.877201080 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.892497063 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.892520905 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.892601967 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.892632008 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.892646074 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.892678022 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.906394958 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.906411886 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.906474113 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.906482935 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.906524897 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.919796944 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.919815063 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.919878960 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.919887066 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.919938087 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.932010889 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.932027102 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.932094097 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.932107925 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.932153940 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.943653107 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.943692923 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.943727970 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:13.943730116 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.943758965 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.943798065 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.943871975 CEST	49779	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:13.943882942 CEST	443	49779	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.195009947 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.195050955 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.195178986 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.195370913 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.195382118 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.272581100 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.273015022 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.273032904 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.273137093 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.273309946 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.273323059 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.529674053 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.529735088 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.530179024 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.530189991 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.531799078 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.531805038 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.568584919 CEST	80	49781	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:14.568682909 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.568845987 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.598270893 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.598341942 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.598766088 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.598774910 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.600459099 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.600465059 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.847845078 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.847946882 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.864777088 CEST	80	49781	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:14.866297007 CEST	80	49781	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:14.866313934 CEST	80	49781	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:14.866369009 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.866399050 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.866409063 CEST	49781	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:14.869986057 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.870008945 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.870050907 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.870112896 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.870131969 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.870208979 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892317057 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.892375946 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.892414093 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892422915 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.892452002 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892477989 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892537117 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.892590046 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892635107 CEST	49780	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.892653942 CEST	443	49780	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.939661026 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.939690113 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.939712048 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.939742088 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.939791918 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.939806938 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.939862013 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.966485977 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.966506958 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.966577053 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:14.966586113 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:14.966633081 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.087944031 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.087973118 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.088099957 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.088130951 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.088195086 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.119028091 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.119052887 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.119251013 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.119312048 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.119388103 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.148025036 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.148046017 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.148178101 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.148207903 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.148293972 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.162511110 CEST	80	49781	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:15.238178015 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.238214016 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.238373041 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.238403082 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.238507986 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.256891012 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.256921053 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.257031918 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.257040024 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.257097006 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.277575970 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.277607918 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.277728081 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.277750969 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.277858973 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.299823999 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.299846888 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.300023079 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.300051928 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.300123930 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.324481964 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.324508905 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.324615955 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.324630976 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.324666023 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.325020075 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.345346928 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.345396996 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.345446110 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.345474005 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.345518112 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.345518112 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.363571882 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.363606930 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.363663912 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.363672018 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.363701105 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.363723040 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.397566080 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.397587061 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.397650957 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.397659063 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.397686005 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.397701025 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.411011934 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.411034107 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.411084890 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.411092997 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.411123991 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.411144972 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.426281929 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.426306009 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.426368952 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.426377058 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.426417112 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.441803932 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.441824913 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.441888094 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.441895962 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.441941023 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.455616951 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.455640078 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.455693007 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.455699921 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.455725908 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.455746889 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.468122959 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.468146086 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.468234062 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.468241930 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.468282938 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.481230021 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.481251001 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.481312990 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.481321096 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.481360912 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493068933 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.493120909 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.493149996 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493156910 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.493175030 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.493179083 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493196964 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493227005 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493346930 CEST	49782	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.493361950 CEST	443	49782	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.738622904 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.738672972 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.738774061 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.738979101 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.738997936 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.820569038 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.820605993 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.820688963 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.820890903 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:15.820905924 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:15.821564913 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.070586920 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.070713043 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.071129084 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.071146011 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.072788954 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.072802067 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.122879028 CEST	80	49785	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:16.123034954 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.123207092 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.145389080 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.145562887 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.146064997 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.146079063 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.148397923 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.148406029 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.389590025 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.389671087 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.411840916 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.411874056 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.411920071 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.411983967 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.412008047 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.412043095 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.412091017 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.424277067 CEST	80	49785	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:16.425606012 CEST	80	49785	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:16.425621986 CEST	80	49785	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:16.425687075 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.425687075 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.425709963 CEST	49785	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:16.434226036 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.434272051 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.434320927 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.434335947 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.434364080 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.434382915 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.434426069 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.434529066 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.434529066 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.464639902 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.464751959 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.487165928 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.487176895 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.487214088 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.487277031 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.487308025 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.487328053 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.487364054 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.514066935 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.514098883 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.514229059 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.514256001 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.514307976 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.637588978 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.637624025 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.637691975 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.637718916 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.637747049 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.637775898 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.668787956 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.668813944 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.668898106 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.668920994 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.668968916 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.697647095 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.697675943 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.697734118 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.697742939 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.697762966 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.697797060 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.727037907 CEST	80	49785	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:16.748181105 CEST	49783	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.748246908 CEST	443	49783	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.783819914 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.783842087 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.783946037 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.783963919 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.783974886 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.784013033 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.804405928 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.804430008 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.804480076 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.804488897 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.804538965 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.825253010 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.825275898 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.825494051 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.825510979 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.825581074 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.847954988 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.847979069 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.848061085 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.848068953 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.848126888 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.871555090 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.871577978 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.871635914 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.871644974 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.871679068 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.871706009 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.892009974 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.892030954 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.892085075 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.892093897 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.892168045 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.906949997 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.906991005 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.907027006 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.907032967 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.907075882 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.907124996 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.926304102 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.926328897 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.926399946 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.926408052 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.926456928 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.951412916 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.951436996 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.951488972 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.951497078 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.951536894 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.951560974 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.966392994 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.966423035 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.966479063 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.966485977 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.966510057 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.966552019 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.981914997 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.981937885 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.982004881 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.982013941 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.982039928 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.982069016 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.995995998 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.996021986 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.996123075 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:16.996144056 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:16.996193886 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.008388996 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.008408070 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.008497953 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.008514881 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.008562088 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.021531105 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.021554947 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.021621943 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.021637917 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.021666050 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.021692038 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.033401012 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.033423901 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.033477068 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.033490896 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.033520937 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.033549070 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035207987 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.035264015 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035271883 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.035290956 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.035320997 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035330057 CEST	443	49784	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.035342932 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035342932 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035367966 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.035381079 CEST	49784	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.299318075 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.299354076 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.299457073 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.299669981 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.299686909 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.386285067 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.386324883 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.386473894 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.386703014 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.386751890 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.386769056 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.630654097 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.630783081 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.631237030 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.631244898 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.632932901 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.632940054 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.685276985 CEST	80	49788	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:17.685380936 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.685528994 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.712935925 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.713032961 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.713409901 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.713422060 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.715446949 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.715456009 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.971466064 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.971524000 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.971550941 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.971566916 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.971580029 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.971600056 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.971659899 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.971659899 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.984061956 CEST	80	49788	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:17.986418009 CEST	80	49788	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:17.986433983 CEST	80	49788	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:17.986507893 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.986509085 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.986582041 CEST	49788	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:17.993660927 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.993704081 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.993771076 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.993771076 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.993794918 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.993833065 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:17.993863106 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.993886948 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.993989944 CEST	49786	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:17.994004965 CEST	443	49786	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.032267094 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.032341003 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.054635048 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.054651022 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.054728985 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.054800034 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.054817915 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.054840088 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.054883003 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.081435919 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.081464052 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.081510067 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.081531048 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.081545115 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.081582069 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.206119061 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.206146955 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.206228971 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.206244946 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.206286907 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.232867956 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.232925892 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.232949018 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.232966900 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.232990026 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.233010054 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.261796951 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.261818886 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.261884928 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.261897087 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.261945009 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.285989046 CEST	80	49788	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:18.288727999 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.288752079 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.288796902 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.288808107 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.288820982 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.288846016 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.368710041 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.368742943 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.368781090 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.368792057 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.368819952 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.368838072 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.393101931 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.393138885 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.393179893 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.393188953 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.393218994 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.393230915 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.415879011 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.415900946 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.415932894 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.415951014 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.415967941 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.415993929 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.436758995 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.436781883 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.436817884 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.436829090 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.436857939 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.436868906 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.457649946 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.457670927 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.457715988 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.457724094 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.457746029 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.457762957 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.475831985 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.475852966 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.475897074 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.475904942 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.475927114 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.475944996 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.495373011 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.495394945 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.495476007 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.495496988 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.495537043 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.521084070 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.521104097 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.521172047 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.521183014 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.521225929 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.535871029 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.535892010 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.535943985 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.535953999 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.535968065 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.535994053 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.546962023 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.547029018 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.547043085 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.547059059 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.547080994 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.547117949 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.560982943 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.561014891 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.561054945 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.561063051 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.561075926 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.561096907 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.573476076 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.573508978 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.573554039 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.573560953 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.573582888 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.573601961 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.586507082 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.586533070 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.586842060 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.586850882 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.586895943 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.600246906 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.600270033 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.600347996 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.600357056 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.600398064 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.602219105 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.602283001 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.602293015 CEST	443	49787	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.602336884 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.602369070 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.602369070 CEST	49787	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.860743999 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.860778093 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.860869884 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.861079931 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.861104965 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.957473993 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.957564116 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.957668066 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.957858086 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:18.957890034 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:18.958177090 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.190948009 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.191021919 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.191489935 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.191500902 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.193670034 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.193675995 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.259398937 CEST	80	49791	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:19.259493113 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.259633064 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.283847094 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.283929110 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.284430027 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.284461021 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.285938025 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.285952091 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.532701015 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.532731056 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.532751083 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.532778025 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.532803059 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.532815933 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.532865047 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555185080 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.555252075 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.555311918 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555344105 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.555360079 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555399895 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555408001 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.555459976 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555562973 CEST	49789	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.555577993 CEST	443	49789	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.560822010 CEST	80	49791	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:19.562324047 CEST	80	49791	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:19.562339067 CEST	80	49791	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:19.562382936 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.562414885 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.562438965 CEST	49791	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:19.603312016 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.603413105 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.625616074 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.625624895 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.625662088 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.625704050 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.625750065 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.625788927 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.625823975 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.652606010 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.652627945 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.652717113 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.652750015 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.652806997 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.776268959 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.776288986 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.776365042 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.776398897 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.776444912 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.807384968 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.807401896 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.807497978 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.807537079 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.807593107 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.836407900 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.836427927 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.836523056 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.836560011 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.836623907 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.863524914 CEST	80	49791	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:19.922306061 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.922323942 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.922405005 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.922435045 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.922489882 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.943048954 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.943068981 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.943147898 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.943171978 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.943214893 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.963763952 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.963783026 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.963869095 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.963917971 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.963982105 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.986128092 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.986151934 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.986228943 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:19.986310005 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:19.986371994 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.010076046 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.010143042 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.010200024 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.010277033 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.010343075 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.010343075 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.030505896 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.030550957 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.030600071 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.030625105 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.030648947 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.030680895 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.048497915 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.048541069 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.048585892 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.048602104 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.048629999 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.048654079 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.068063974 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.068134069 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.068166018 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.068181992 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.068207026 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.068229914 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.092340946 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.092386007 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.092427015 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.092448950 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.092472076 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.092503071 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.107264042 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.107290983 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.107378006 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.107378006 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.107409954 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.107455969 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.122565985 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.122587919 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.122639894 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.122653008 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.122678041 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.122710943 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.136514902 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.136542082 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.136593103 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.136636972 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.136670113 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.136688948 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.148941994 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.148963928 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.149022102 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.149054050 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.149068117 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.149099112 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.161864996 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.161909103 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.161951065 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.161967993 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.161995888 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.162022114 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174170017 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.174211025 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.174276114 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174290895 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.174324036 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174341917 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174370050 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.174428940 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174428940 CEST	49790	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.174449921 CEST	443	49790	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.446676016 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.446708918 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.446805954 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.447086096 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.447101116 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.525439024 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.525481939 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.525578022 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.525825024 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.525840044 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.526221037 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:20.778671026 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.778770924 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.779292107 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.779301882 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.781475067 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.781481028 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.827390909 CEST	80	49794	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:20.827490091 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:20.827626944 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:20.855957985 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.856053114 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.856455088 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.856461048 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:20.858134985 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:20.858140945 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.119824886 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.119889975 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.119921923 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.119934082 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.119972944 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.119987011 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.120019913 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.120043993 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.128694057 CEST	80	49794	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:21.130290985 CEST	80	49794	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:21.130315065 CEST	80	49794	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:21.130353928 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:21.130392075 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:21.130439997 CEST	49794	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:21.144165039 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.144210100 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.144263029 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.144275904 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.144303083 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.144324064 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.144368887 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.144421101 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.144459963 CEST	49792	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.144471884 CEST	443	49792	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.197721004 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.197782993 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.197829008 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.197828054 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.197901011 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.197901011 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.197922945 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.197976112 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.224380970 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.224432945 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.224495888 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.224509954 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.224519968 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.224550009 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.346252918 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.346287966 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.346329927 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.346349955 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.346360922 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.346390009 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.377512932 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.377547979 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.377589941 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.377599955 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.377625942 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.377659082 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.406488895 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.406548023 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.406569004 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.406588078 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.406611919 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.406630993 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.431684971 CEST	80	49794	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:21.494889021 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.494956017 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.494996071 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.495048046 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.495079994 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.495114088 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.515419006 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.515474081 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.515516996 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.515539885 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.515562057 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.515579939 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.535980940 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.536029100 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.536078930 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.536087990 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.536147118 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.558387041 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.558450937 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.558482885 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.558517933 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.558547974 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.558573008 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.581945896 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.581971884 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.582030058 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.582048893 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.582082033 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.582128048 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.602138996 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.602185965 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.602233887 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.602274895 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.602309942 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.602330923 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.620347023 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.620393991 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.620434046 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.620501041 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.620542049 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.620564938 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.654463053 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.654510021 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.654546022 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.654571056 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.654584885 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.654620886 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.670944929 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.670964956 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.671030045 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.671051979 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.671077013 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.671132088 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.684871912 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.684894085 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.684957981 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.684987068 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.685034037 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.700786114 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.700835943 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.700898886 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.700926065 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.700946093 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.700962067 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.712516069 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.712575912 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.712615013 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.712651014 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.712682009 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.712697983 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.727300882 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.727348089 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.727380037 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.727401018 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.727412939 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.727443933 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.738161087 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.738204956 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.738245964 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.738253117 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.738281965 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.738301992 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.749870062 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.749921083 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.749953985 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.749968052 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.749989986 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.750013113 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.750087976 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.750112057 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:21.750119925 CEST	443	49793	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:21.750152111 CEST	49793	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.006607056 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.006642103 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.007024050 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.007024050 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.007052898 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.083713055 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.084403992 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.084470987 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.084577084 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.084856987 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.084903955 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.337255955 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.337389946 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.337853909 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.337861061 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.339530945 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.339539051 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.379861116 CEST	80	49796	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:22.379962921 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.380131960 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.417833090 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.417897940 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.418329954 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.418343067 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.419878006 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.419889927 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.678014040 CEST	80	49796	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:22.679375887 CEST	80	49796	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:22.679409027 CEST	80	49796	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:22.679455996 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.679538965 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.679538965 CEST	49796	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:22.683654070 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.683715105 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.683753014 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.683787107 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.683819056 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.683845043 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.683845043 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.683870077 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.708385944 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.708434105 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.708558083 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.708578110 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.708578110 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.708623886 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.708686113 CEST	49795	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.708705902 CEST	443	49795	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.736442089 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.736514091 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.759083986 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.759108067 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.759165049 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.759174109 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.759197950 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.759217978 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.759243011 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.786586046 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.786629915 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.786716938 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.786716938 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.786751032 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.786794901 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.910573959 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.910613060 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.910697937 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.910711050 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.910753012 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.942421913 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.942486048 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.942536116 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.942547083 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.942568064 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.942600012 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.971929073 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.971975088 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.972016096 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.972029924 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:22.972047091 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.972064018 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:22.975500107 CEST	80	49796	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:23.055279970 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.055330992 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.055388927 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.055434942 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.055470943 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.055497885 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.076301098 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.076339960 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.076375961 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.076400995 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.076427937 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.076451063 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.097358942 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.097377062 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.097450018 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.097466946 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.097533941 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.120171070 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.120187044 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.120265961 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.120284081 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.120337963 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.144526958 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.144545078 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.144604921 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.144622087 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.144679070 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.165309906 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.165330887 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.165385008 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.165400982 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.165431976 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.165477037 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.177536964 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.177613974 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.177637100 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.177650928 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.177678108 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.177696943 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.197181940 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.197201014 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.197283983 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.197304964 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.197360992 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.222821951 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.222855091 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.222903013 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.222922087 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.222946882 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.222978115 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.237829924 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.237849951 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.237915993 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.237931013 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.237984896 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.251085043 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.251104116 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.251149893 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.251173019 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.251198053 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.251230001 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.264934063 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.264949083 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.265017986 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.265033960 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.265094995 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.277489901 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.277506113 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.277569056 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.277582884 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.277637959 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.290541887 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.290558100 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.290620089 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.290636063 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.290735006 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.304088116 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.304121971 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.304162025 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.304181099 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.304205894 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.304229021 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.305921078 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.305984974 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.305998087 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.306020021 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.306072950 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.306072950 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.306091070 CEST	443	49797	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.306128979 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.306129932 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.306129932 CEST	49797	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.576606035 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.576661110 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.576772928 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.576988935 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.577011108 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.664074898 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:23.664197922 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.664237022 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.664320946 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.664503098 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.664519072 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.909096956 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.909219980 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.909754992 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.909782887 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.912024975 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.912039042 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.965351105 CEST	80	49799	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:23.965475082 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:23.965673923 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:23.988276005 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.988351107 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.988898993 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.988905907 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:23.990428925 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:23.990433931 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.254230022 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.254293919 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.254333973 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.254342079 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.254380941 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.254407883 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.254439116 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.254481077 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.266793966 CEST	80	49799	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:24.268052101 CEST	80	49799	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:24.268083096 CEST	80	49799	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:24.268131018 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:24.268152952 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:24.268196106 CEST	49799	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:24.278609037 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278686047 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278700113 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.278726101 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278755903 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.278778076 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.278791904 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278846025 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278851986 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.278912067 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.278927088 CEST	443	49798	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.278959990 CEST	49798	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.331123114 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.331141949 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.331198931 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.331222057 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.331222057 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.331238985 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.331275940 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.331326962 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.357774973 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.357793093 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.357887983 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.357894897 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.357949018 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.479496002 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.479515076 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.479589939 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.479604006 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.479659081 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.510440111 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.510461092 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.510513067 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.510524035 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.510544062 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.510562897 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.539472103 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.539490938 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.539592028 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.539604902 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.539730072 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.569478989 CEST	80	49799	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:24.627676964 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.627701044 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.627932072 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.627953053 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.628070116 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.648267984 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.648287058 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.648436069 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.648447037 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.648652077 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.668821096 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.668838024 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.669035912 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.669049025 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.669244051 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.691107988 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.691133022 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.691265106 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.691273928 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.691435099 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.714581966 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.714601040 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.714721918 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.714730024 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.714850903 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.734625101 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.734642982 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.734818935 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.734834909 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.735009909 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.752995014 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.753047943 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.753110886 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.753122091 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.753168106 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.753473043 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.787094116 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.787111998 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.787209988 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.787220955 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.787316084 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.800333023 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.800354004 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.800461054 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.800471067 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.800530910 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.815695047 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.815709114 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.815785885 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.815794945 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.815838099 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.831245899 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.831270933 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.831463099 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.831470013 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.831505060 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.845109940 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.845128059 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.845470905 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.845485926 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.845974922 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.857763052 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.857781887 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.859694004 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.859719992 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.859774113 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.870767117 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.870784998 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.870863914 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.870870113 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.871045113 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.882425070 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.882489920 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.882524014 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:24.882523060 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.882585049 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.882585049 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.882754087 CEST	49800	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:24.882772923 CEST	443	49800	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.140832901 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.140870094 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.141037941 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.141310930 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.141321898 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.231033087 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.231306076 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.231399059 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.231496096 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.231703043 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.231733084 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.471364021 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.471532106 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.471894026 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.471900940 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.474225998 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.474231005 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.527335882 CEST	80	49802	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:25.527425051 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.527621031 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.555520058 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.555602074 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.555931091 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.555960894 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.557467937 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.557481050 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.812447071 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.812513113 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.812556982 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.812580109 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.812580109 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.812596083 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.812644958 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.812644958 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.823472977 CEST	80	49802	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:25.824846983 CEST	80	49802	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:25.824961901 CEST	80	49802	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:25.824980974 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.824980974 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.825063944 CEST	49802	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:25.836730957 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.836775064 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.836822033 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.836842060 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.836884975 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.836885929 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.836971998 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.837043047 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.837043047 CEST	49801	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.837050915 CEST	443	49801	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.896833897 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.896858931 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.896876097 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.896950960 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.896991968 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.897041082 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.897063971 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.923536062 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.923557997 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.923621893 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:25.923638105 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:25.923677921 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.044992924 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.045013905 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.045125008 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.045149088 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.045191050 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.076088905 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.076112032 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.076159000 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.076168060 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.076191902 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.076205969 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.105226994 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.105242968 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.105319023 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.105367899 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.105422020 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.121043921 CEST	80	49802	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:26.193650007 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.193669081 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.193763971 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.193789005 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.193844080 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.214102983 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.214118004 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.214181900 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.214195967 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.214248896 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.234730005 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.234750032 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.234852076 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.234870911 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.234922886 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.257025003 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.257052898 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.257110119 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.257131100 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.257160902 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.257183075 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.280421019 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.280436039 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.280503035 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.280517101 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.280570030 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.300477982 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.300493002 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.300558090 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.300570965 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.300626040 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.318743944 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.318758965 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.318820953 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.318835020 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.318888903 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.352929115 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.352942944 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.353008032 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.353013992 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.353053093 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.366353035 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.366384029 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.366420984 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.366427898 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.366453886 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.366471052 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.381547928 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.381562948 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.381623030 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.381628036 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.381665945 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.397170067 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.397186041 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.397236109 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.397243023 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.397279024 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.411094904 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.411111116 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.411175966 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.411181927 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.411223888 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.423685074 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.423701048 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.423764944 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.423770905 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.423808098 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.436719894 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.436736107 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.436800003 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.436805964 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.436846018 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.448350906 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.448390961 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.448421955 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.448426008 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.448479891 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.448693037 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.448693037 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.722790003 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.722830057 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.722925901 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.723201990 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.723220110 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.763329983 CEST	49803	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.763356924 CEST	443	49803	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.810636997 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:26.810846090 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.810870886 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:26.810944080 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.811186075 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:26.811202049 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.053817034 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.054069042 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.054502010 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.054528952 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.056822062 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.056835890 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.109071970 CEST	80	49805	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:27.109174013 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:27.109484911 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:27.134517908 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.134618044 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.135128975 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.135139942 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.136540890 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.136548996 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.372976065 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.373089075 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.395003080 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.395029068 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.395070076 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.395136118 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.395169973 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.395231962 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.395266056 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.408004045 CEST	80	49805	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:27.409312010 CEST	80	49805	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:27.409353018 CEST	80	49805	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:27.409377098 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:27.409398079 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:27.409416914 CEST	49805	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:27.417344093 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.417433977 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.417460918 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.417534113 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.417568922 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.417574883 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.417604923 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.417630911 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.417741060 CEST	49804	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.417773008 CEST	443	49804	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.477010012 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.477046967 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.477066040 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.477092028 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.477148056 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.477157116 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.477217913 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.503755093 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.503801107 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.503895998 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.503906965 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.503972054 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.625459909 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.625487089 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.625569105 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.625591993 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.625646114 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.656500101 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.656527042 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.656579018 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.656598091 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.656618118 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.656641960 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.685544014 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.685564041 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.685631037 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.685648918 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.685698986 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.707849026 CEST	80	49805	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:27.773868084 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.773891926 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.773962975 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.773983002 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.774030924 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.794491053 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.794550896 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.794665098 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.794672966 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.794714928 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.794924021 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.814970016 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.815016985 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.815072060 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.815079927 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.815138102 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.837379932 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.837395906 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.837532043 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.837543964 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.837588072 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.860589981 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.860613108 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.860707998 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.860722065 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.860770941 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.880856037 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.880898952 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.880951881 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.880974054 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.880990982 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.881014109 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.899131060 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.899174929 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.899207115 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.899235964 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.899374008 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.899374008 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.933417082 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.933465958 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.933528900 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.933542013 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.933566093 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.933588982 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.946604967 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.946647882 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.946681023 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.946686983 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.946713924 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.946732044 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.961843967 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.961885929 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.961914062 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.961925983 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.961937904 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.961963892 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.978429079 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.978471041 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.978502035 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.978508949 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.978532076 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.978547096 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.991314888 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.991358042 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.991389036 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.991403103 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:27.991415024 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:27.991444111 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.004704952 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.004753113 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.004811049 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.004837036 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.004859924 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.004893064 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.016858101 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.016927958 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.016946077 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.016954899 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.016983032 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.017003059 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.028374910 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.028434038 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.028465986 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.028481960 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.028527975 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.028578043 CEST	49806	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.028593063 CEST	443	49806	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.280014992 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.280078888 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.280194998 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.280380964 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.280410051 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.374427080 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.374471903 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.374571085 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.374764919 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.374792099 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.375127077 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.610795975 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.610879898 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.611380100 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.611392975 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.613022089 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.613032103 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.671278954 CEST	80	49809	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:28.671391964 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.671539068 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.705332041 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.705425024 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.705784082 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.705796003 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.707376003 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.707386971 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.930286884 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.930373907 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.952685118 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.952711105 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.952756882 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.952790022 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.952812910 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.952843904 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.952938080 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.967561960 CEST	80	49809	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:28.968980074 CEST	80	49809	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:28.969018936 CEST	80	49809	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:28.969074011 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.969074011 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.969178915 CEST	49809	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:28.974890947 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.974951982 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.974980116 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.975003958 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.975029945 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.975063086 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.975126028 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.975164890 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:28.975191116 CEST	443	49807	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:28.975214005 CEST	49807	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.046020985 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.046082020 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.046140909 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.046164989 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.046196938 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.046204090 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.046242952 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.046257019 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.046287060 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.046305895 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.072566032 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.072587013 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.072655916 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.072684050 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.072705030 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.072731972 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.194514036 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.194570065 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.194614887 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.194643974 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.194669962 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.194709063 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.225482941 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.225517035 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.225563049 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.225585938 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.225609064 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.225634098 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.254518032 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.254571915 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.254657984 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.254657984 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.254684925 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.254765034 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.265168905 CEST	80	49809	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:29.342878103 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.342911005 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.342969894 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.343003035 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.343029022 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.343051910 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.363359928 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.363383055 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.363467932 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.363485098 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.363538027 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.383949041 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.383970022 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.384036064 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.384052992 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.384151936 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.406481981 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.406505108 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.406568050 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.406591892 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.406640053 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.429749966 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.429780960 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.429826021 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.429850101 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.429862022 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.429893017 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.449837923 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.449860096 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.449917078 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.449937105 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.449961901 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.450002909 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.468183994 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.468208075 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.468277931 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.468293905 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.468348026 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.502445936 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.502477884 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.502547026 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.502567053 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.502590895 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.502635002 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.515686989 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.515708923 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.515763044 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.515782118 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.515805006 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.515829086 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.530883074 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.530914068 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.530971050 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.530988932 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.531014919 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.531044960 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.546577930 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.546658039 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.546720028 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.546720028 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.546765089 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.546817064 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.560517073 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.560561895 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.560589075 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.560600996 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.560617924 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.560631990 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.572915077 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.572957993 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.572993040 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.573007107 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.573026896 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.573060989 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.586282015 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.586344004 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.586404085 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.586419106 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.586448908 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.586468935 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597714901 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.597752094 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.597809076 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597827911 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.597862959 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.597868919 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597893000 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597913027 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597948074 CEST	49808	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.597975969 CEST	443	49808	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.826813936 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.826899052 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.827024937 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.827230930 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.827284098 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.922081947 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:29.922388077 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.922442913 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:29.922523975 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.922720909 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:29.922734022 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.152290106 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.152429104 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.152990103 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.153017998 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.155322075 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.155338049 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.220839024 CEST	80	49811	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:30.220985889 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:30.221255064 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:30.255345106 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.255471945 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.255855083 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.255867004 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.257276058 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.257282972 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.471940041 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.472064018 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.494226933 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.494237900 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.494340897 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.494471073 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.494472027 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.494539022 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.494622946 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.516583920 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.516649961 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.516781092 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.516781092 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.516801119 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.516833067 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.516875029 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.516920090 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.516942024 CEST	443	49810	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.516983986 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.517013073 CEST	49810	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.519706011 CEST	80	49811	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:30.520910978 CEST	80	49811	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:30.520987988 CEST	80	49811	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:30.520991087 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:30.521058083 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:30.521058083 CEST	49811	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:30.574487925 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.574579000 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.596877098 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.596901894 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.596945047 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.597004890 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.597028971 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.597060919 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.597084045 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.623615026 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.623666048 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.623730898 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.623786926 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.623915911 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.623915911 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.747438908 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.747510910 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.747580051 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.747612953 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.747740984 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.747741938 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.778496027 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.778527021 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.778644085 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.778657913 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.778709888 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.807681084 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.807765007 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.807883978 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.807883978 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.807962894 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.808024883 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.819577932 CEST	80	49811	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:30.893671036 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.893716097 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.893872023 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.893872023 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.893894911 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.893959045 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.914249897 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.914297104 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.914428949 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.914429903 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.914450884 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.914509058 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.934894085 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.934938908 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.934987068 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.935003996 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.935036898 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.935056925 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.957422018 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.957469940 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.957623959 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.957623959 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.957644939 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.957703114 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.981115103 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.981163025 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.981231928 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.981247902 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:30.981385946 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:30.981385946 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.001580954 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.001626015 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.001687050 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.001710892 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.001734018 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.001777887 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.019779921 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.019824982 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.019876003 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.019891977 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.019918919 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.019938946 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.039192915 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.039235115 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.039283037 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.039297104 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.039323092 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.039345026 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.063750029 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.063791990 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.063849926 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.063858032 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.063885927 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.063908100 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.078687906 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.078731060 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.078771114 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.078778028 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.078803062 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.078819036 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.094119072 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.094160080 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.094211102 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.094222069 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.094249010 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.094368935 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.107927084 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.107966900 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.108016014 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.108027935 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.108053923 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.108074903 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.120356083 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.120417118 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.120485067 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.120513916 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.120541096 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.120560884 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.133228064 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.133280993 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.133328915 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.133344889 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.133377075 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.133400917 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.144970894 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.145023108 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.145080090 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.145095110 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.145143032 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.145175934 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.145216942 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.145232916 CEST	443	49812	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.145248890 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.145248890 CEST	49812	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.410553932 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.410604000 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.410710096 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.410902977 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.410921097 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.504795074 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.504847050 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.504940987 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.505173922 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.505192041 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.505664110 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:31.740716934 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.740803003 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.741323948 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.741334915 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.742942095 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.742950916 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.801873922 CEST	80	49815	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:31.801985025 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:31.802103996 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:31.836612940 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.836729050 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.837063074 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.837074995 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:31.838505030 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:31.838514090 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.081376076 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.081429005 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.081460953 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.081470013 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.081497908 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.081507921 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.081552029 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.097980976 CEST	80	49815	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:32.099137068 CEST	80	49815	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:32.099212885 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:32.099219084 CEST	80	49815	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:32.099261999 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:32.099286079 CEST	49815	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:32.105545044 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.105588913 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.105607033 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.105634928 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.105679989 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.105801105 CEST	49813	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.105814934 CEST	443	49813	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.178002119 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.178030968 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.178050995 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.178082943 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.178131104 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.178143978 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.178188086 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.205174923 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.205240965 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.205279112 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.205307961 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.205323935 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.205344915 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.326339960 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.326374054 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.326484919 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.326515913 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.326567888 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.357604980 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.357641935 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.357723951 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.357744932 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.357785940 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.387141943 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.387161970 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.387242079 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.387264967 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.387307882 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.395039082 CEST	80	49815	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:32.479789019 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.479813099 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.479860067 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.479877949 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.479893923 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.480171919 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.501019001 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.501058102 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.501106977 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.501115084 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.501137018 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.501152992 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.522113085 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.522138119 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.522185087 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.522192955 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.522219896 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.522238970 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.544652939 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.544672966 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.544717073 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.544728041 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.544887066 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.544887066 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.567945957 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.567972898 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.568042040 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.568063021 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.568247080 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.588069916 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.588094950 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.588180065 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.588186979 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.588232040 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.606431961 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.606448889 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.606548071 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.606555939 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.606592894 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.639128923 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.639144897 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.639228106 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.639235020 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.639281034 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.652880907 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.652894020 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.652976990 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.652997971 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.653040886 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.668570995 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.668585062 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.668705940 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.668725967 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.668771982 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.684962034 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.684977055 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.685079098 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.685086012 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.685132027 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.699666023 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.699678898 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.699743986 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.699748993 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.699786901 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.712775946 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.712791920 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.712860107 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.712866068 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.712909937 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.726377964 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.726391077 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.726459026 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.726479053 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.726522923 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.738461018 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.738509893 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.738533020 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.738534927 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.738555908 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.738575935 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.738663912 CEST	49814	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.738681078 CEST	443	49814	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.984709024 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.984810114 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:32.984961033 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.985249996 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:32.985291004 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.071850061 CEST	49817	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:33.072143078 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.072190046 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.072288036 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.072499990 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.072514057 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.309318066 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.309479952 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.309953928 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.309981108 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.311566114 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.311579943 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.368067026 CEST	80	49817	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:33.368197918 CEST	49817	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:33.368349075 CEST	49817	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:33.396214008 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.396286011 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.396719933 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.396730900 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.398279905 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.398287058 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.629120111 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.629322052 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.651288033 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.651310921 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.651359081 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.651446104 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.651473045 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.651523113 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.651571989 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.664305925 CEST	80	49817	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:33.665770054 CEST	80	49817	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:33.665808916 CEST	80	49817	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:33.665867090 CEST	49817	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:33.665910006 CEST	49817	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:33.673492908 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.673535109 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.673576117 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.673614979 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.673675060 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.673858881 CEST	49816	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.673875093 CEST	443	49816	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.738840103 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.738883018 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.738928080 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.739022970 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.739037991 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.739141941 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.765578985 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.765604019 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.765707016 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.765733004 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.765785933 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.888402939 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.888428926 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.888518095 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.888539076 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.888582945 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.919646025 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.919675112 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.919755936 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.919764042 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.919806004 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.949764967 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.949790001 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.949887037 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.949920893 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:33.949960947 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:33.964364052 CEST	80	49817	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:34.035804987 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.035832882 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.035924911 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.035939932 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.035988092 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.056401968 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.056421041 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.056518078 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.056530952 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.056575060 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.077012062 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.077028036 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.077131033 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.077141047 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.077192068 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.099433899 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.099486113 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.099546909 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.099590063 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.099611998 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.099642992 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.123047113 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.123096943 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.123181105 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.123199940 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.123254061 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.143439054 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.143466949 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.143593073 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.143611908 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.143661022 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.161468983 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.161485910 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.161571980 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.161583900 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.161627054 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.195297956 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.195316076 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.195384979 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.195393085 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.195432901 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.208874941 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.208892107 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.208961010 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.208967924 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.209007978 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.223877907 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.223896980 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.224008083 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.224015951 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.224056959 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.239515066 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.239545107 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.239634991 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.239640951 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.239679098 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.253577948 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.253634930 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.253699064 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.253707886 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.253746033 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.266002893 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.266021013 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.266078949 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.266088963 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.266127110 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.278935909 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.278955936 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.279028893 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.279042006 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.279082060 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.290640116 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.290679932 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.290710926 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.290715933 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.290730000 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.290741920 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.290766954 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.290899038 CEST	49818	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.290913105 CEST	443	49818	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.574228048 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.574280024 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.574414968 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.574723959 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.574742079 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.672902107 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.672980070 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.673136950 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.673372030 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.673389912 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.673686981 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:34.903572083 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.903762102 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.904320955 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.904334068 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.906811953 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.906817913 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.972744942 CEST	80	49821	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:34.972935915 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:34.973200083 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:34.997165918 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:34.997273922 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.997807980 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:34.997819901 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.000072956 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.000087023 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.246771097 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.246797085 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.246844053 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.246922016 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.246957064 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.246982098 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.247010946 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271231890 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.271378040 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271498919 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.271562099 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271572113 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.271589994 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.271621943 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271657944 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271725893 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271743059 CEST	443	49819	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.271759987 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271780968 CEST	49819	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.271817923 CEST	80	49821	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:35.273297071 CEST	80	49821	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:35.273339033 CEST	80	49821	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:35.273385048 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:35.273466110 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:35.273467064 CEST	49821	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:35.338877916 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.338906050 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.338943958 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.339018106 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.339051962 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.339075089 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.339118004 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.365612984 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.365631104 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.365797997 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.365823030 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.365881920 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.487236023 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.487267017 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.487370014 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.487406969 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.487482071 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.518460989 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.518479109 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.518560886 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.518574953 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.518613100 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.547533989 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.547553062 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.547631979 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.547657013 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.547707081 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.572230101 CEST	80	49821	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:35.635664940 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.635696888 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.635804892 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.635833979 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.635880947 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.656332970 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.656371117 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.656505108 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.656534910 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.656583071 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.676907063 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.676939011 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.677052021 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.677095890 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.677150965 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.699209929 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.699243069 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.699362040 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.699395895 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.699438095 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.722678900 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.722708941 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.722820997 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.722857952 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.722908020 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.742811918 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.742844105 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.742938995 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.742978096 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.743025064 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.761126995 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.761152029 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.761224985 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.761250019 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.761301041 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.795017958 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.795046091 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.795188904 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.795217991 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.795279980 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.808459997 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.808478117 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.808552027 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.808568001 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.808619022 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.823568106 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.823586941 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.823674917 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.823699951 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.823754072 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.839155912 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.839174986 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.839262962 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.839287043 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.839483023 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.853199959 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.853225946 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.853277922 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.853286028 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.853317976 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.853343964 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.865685940 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.865716934 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.865799904 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.865830898 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.865885019 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.878804922 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.878832102 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.878921032 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.878954887 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.879002094 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.890463114 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.890530109 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.890554905 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:35.890554905 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.890609026 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.890790939 CEST	49820	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:35.890811920 CEST	443	49820	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.136262894 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.136349916 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.136508942 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.136790991 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.136811018 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.238296032 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.238579035 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.238637924 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.238771915 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.239010096 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.239026070 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.463576078 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.463728905 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.464174986 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.464184999 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.465811968 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.465818882 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.544004917 CEST	80	49823	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:36.544230938 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.544471979 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.566345930 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.566437960 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.567003012 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.567009926 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.568603039 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.568607092 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.809674025 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.809699059 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.809719086 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.809775114 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.809809923 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.809818983 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.809863091 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.832231045 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.832282066 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.832303047 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.832310915 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.832336903 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.832678080 CEST	49822	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.832695961 CEST	443	49822	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.848514080 CEST	80	49823	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:36.849920988 CEST	80	49823	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:36.849957943 CEST	80	49823	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:36.849987030 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.850028992 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.850048065 CEST	49823	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:36.911986113 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.912024021 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.912039042 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.912115097 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.912137032 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.912151098 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.912184954 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.939282894 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.939306021 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.939368010 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:36.939389944 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:36.939431906 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.060322046 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.060345888 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.060431004 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.060452938 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.060497999 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.091837883 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.091856956 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.091938972 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.091944933 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.091980934 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.121160984 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.121182919 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.121346951 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.121376038 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.121465921 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.151475906 CEST	80	49823	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:37.208657026 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.208683968 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.208803892 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.208826065 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.208868027 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.229315042 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.229341030 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.229424000 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.229438066 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.229482889 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.250057936 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.250088930 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.250318050 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.250346899 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.250411034 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.272284985 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.272311926 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.272411108 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.272445917 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.272507906 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.295840025 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.295864105 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.295972109 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.296003103 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.296066046 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.316011906 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.316040039 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.316310883 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.316387892 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.316477060 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.334296942 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.334319115 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.334537983 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.334575891 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.334640980 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.368047953 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.368074894 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.368345976 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.368381023 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.368446112 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.384885073 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.384903908 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.385004044 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.385021925 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.385051012 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.385075092 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.396655083 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.396678925 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.396801949 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.396871090 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.396948099 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.412221909 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.412249088 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.412523031 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.412591934 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.412673950 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.426228046 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.426264048 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.426367998 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.426386118 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.426454067 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.438590050 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.438643932 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.438793898 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.438812017 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.438878059 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.451669931 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.451697111 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.451808929 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.451824903 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.451881886 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.463263035 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.463310957 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.463339090 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.463352919 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.463397980 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.463551998 CEST	49824	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.463587046 CEST	443	49824	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.732291937 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.732357025 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.732467890 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.732798100 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.732815027 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.817364931 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.817434072 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.817519903 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.817825079 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:37.817842007 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:37.819458008 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.056138992 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.056313992 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.056822062 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.056873083 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.058499098 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.058511972 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.115643024 CEST	80	49827	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:38.115797043 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.115907907 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.141457081 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.141535044 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.142076015 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.142085075 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.144259930 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.144263983 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.398009062 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.398046970 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.398062944 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.398102045 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.398189068 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.398224115 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.398293972 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.411834955 CEST	80	49827	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:38.413167953 CEST	80	49827	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:38.413254976 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.413263083 CEST	80	49827	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:38.413310051 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.413353920 CEST	49827	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:38.422508955 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.422588110 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.422621012 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.422652006 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.422705889 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.422902107 CEST	49825	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.422930956 CEST	443	49825	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.460752010 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.460789919 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.460822105 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.460844994 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.460871935 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.460889101 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.488394976 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.488405943 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.488440037 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.488466024 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.488476038 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.488498926 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.488521099 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.515197039 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.515239000 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.515271902 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.515296936 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.515312910 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.515343904 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.640217066 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.640269041 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.640398979 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.640453100 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.640499115 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.671567917 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.671637058 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.671695948 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.671730042 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.671747923 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.671783924 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.700268030 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.700320959 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.700368881 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.700381041 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.700403929 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.700418949 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.709436893 CEST	80	49827	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:38.784766912 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.784841061 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.784871101 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.784883976 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.784904957 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.784923077 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.806977987 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.807032108 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.807087898 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.807106018 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.807130098 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.807148933 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.820693970 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.820787907 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.820792913 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.820832014 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.820844889 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.820859909 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.842925072 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.842982054 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.843009949 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.843040943 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.843055010 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.843084097 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.863459110 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.863495111 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.863533020 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.863554001 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.863569975 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.863590956 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.884202957 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.884243965 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.884334087 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.884370089 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.884382963 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.884407043 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.905400038 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.905436993 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.905503035 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.905520916 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.905534029 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.905556917 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.938946009 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.938981056 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.939064980 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.939095020 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.939110994 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.939135075 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.952086926 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.952126980 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.952171087 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.952192068 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.952207088 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.952233076 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.967195034 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.967247009 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.967319012 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.967344046 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.967359066 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.967385054 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.980638027 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.980686903 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.980793953 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.980819941 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.980868101 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.994807959 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.994856119 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.994920015 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.994946957 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:38.994960070 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:38.994986057 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.009253979 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.009278059 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.009357929 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.009386063 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.009399891 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.009424925 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.022377014 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.022403955 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.022483110 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.022491932 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.022546053 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.034107924 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.034132957 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.034183979 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.034192085 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.034212112 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.034235001 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.035942078 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.036001921 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.036007881 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.036031008 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.036045074 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.036056042 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.036061049 CEST	443	49826	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.036071062 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.036123037 CEST	49826	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.311944008 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.311989069 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.312145948 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.312370062 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.312381983 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.398776054 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:39.398842096 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.398866892 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.398964882 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.399205923 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.399218082 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.635943890 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.636025906 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.636514902 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.636526108 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.638674974 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.638679028 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.700213909 CEST	80	49829	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:39.700357914 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:39.700566053 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:39.725966930 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.726063967 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.726589918 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.726599932 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.728372097 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.728378057 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.955730915 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.955805063 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.977993011 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.978004932 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.978044033 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.978121996 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.978132963 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:39.978163958 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:39.978182077 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.000408888 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.000458002 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.000502110 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.000521898 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.000561953 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.000839949 CEST	49828	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.000855923 CEST	443	49828	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.001704931 CEST	80	49829	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:40.003029108 CEST	80	49829	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:40.003081083 CEST	80	49829	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:40.003138065 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:40.003173113 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:40.003174067 CEST	49829	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:40.067687988 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.067722082 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.067770004 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.067892075 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.067960024 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.068000078 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.068038940 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.094402075 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.094455004 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.094552040 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.094573975 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.094600916 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.094631910 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.216286898 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.216315985 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.216439009 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.216497898 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.216568947 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.247554064 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.247606039 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.247673035 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.247733116 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.247770071 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.247793913 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.276537895 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.276602030 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.276657104 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.276685953 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.276702881 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.276734114 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.304389000 CEST	80	49829	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:40.365108967 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.365247965 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.365341902 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.365358114 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.365417957 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.385610104 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.385665894 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.385730982 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.385755062 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.385785103 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.385806084 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.406351089 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.406397104 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.406445026 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.406461954 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.406510115 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.406539917 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.428539038 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.428560019 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.428713083 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.428734064 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.428796053 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.451975107 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.452019930 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.452142954 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.452161074 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.452188969 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.452217102 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.472229958 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.472275019 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.472311020 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.472318888 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.472382069 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.490473032 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.490518093 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.490581036 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.490595102 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.490633011 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.490653038 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.524523020 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.524544001 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.524627924 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.524678946 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.524710894 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.524740934 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.538060904 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.538113117 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.538166046 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.538192987 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.538228035 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.538250923 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.553229094 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.553255081 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.553322077 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.553355932 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.553374052 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.553400993 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.568914890 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.568964005 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.569003105 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.569011927 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.569035053 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.569053888 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.582722902 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.582767963 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.582854986 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.582870007 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.582921028 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.582921028 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.596242905 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.596286058 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.596359015 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.596388102 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.596415043 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.596451044 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.608460903 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.608566999 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.608606100 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.608637094 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.608668089 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.608692884 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.620053053 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.620120049 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.620162964 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.620176077 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.620196104 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.620229006 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.620466948 CEST	49830	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.620496988 CEST	443	49830	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.878882885 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.878938913 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.879044056 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.879354000 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.879371881 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.965475082 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.965481997 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:40.965512037 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:40.965584040 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.965805054 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:40.965821028 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.210681915 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.210800886 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.211282969 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.211292982 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.213494062 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.213499069 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.266913891 CEST	80	49832	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:41.267102957 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:41.267296076 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:41.293207884 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.293340921 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.293860912 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.293872118 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.295478106 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.295481920 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.553775072 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.553801060 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.553817034 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.553906918 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.553949118 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.553965092 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.553992987 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.568315029 CEST	80	49832	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:41.569649935 CEST	80	49832	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:41.569698095 CEST	80	49832	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:41.569741964 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:41.569787025 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:41.569833994 CEST	49832	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:41.578140974 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.578195095 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.578232050 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.578239918 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.578267097 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.578282118 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.578432083 CEST	49831	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.578452110 CEST	443	49831	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.634670019 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.634736061 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.634757042 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.634768963 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.634784937 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.634802103 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.634836912 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.661472082 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.661528111 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.661623955 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.661640882 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.661650896 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.661680937 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.782888889 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.782924891 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.782999039 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.783019066 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.783052921 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.783071995 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.814086914 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.814181089 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.814265013 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.814299107 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.814343929 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.843214989 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.843281984 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.843306065 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.843316078 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.843334913 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.843362093 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.871014118 CEST	80	49832	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:41.931205034 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.931230068 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.931279898 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.931293011 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.931312084 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.931333065 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.951940060 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.952004910 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.952030897 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.952047110 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.952064037 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.952095032 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.972500086 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.972548962 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.972588062 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.972599983 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.972625017 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.972642899 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.994952917 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.995002985 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.995048046 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.995062113 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:41.995100975 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:41.995117903 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.018140078 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.018165112 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.018240929 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.018255949 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.018297911 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.038319111 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.038388014 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.038454056 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.038491964 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.038535118 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.056740999 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.056787014 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.056821108 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.056832075 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.056860924 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.056875944 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.090858936 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.090958118 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.090992928 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.091001034 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.091039896 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.104064941 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.104130983 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.104151011 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.104160070 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.104178905 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.104201078 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.119194031 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.119215012 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.119267941 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.119277000 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.119296074 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.119318008 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.134839058 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.134861946 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.134932995 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.134941101 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.134980917 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.148875952 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.148932934 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.148960114 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.148967981 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.148987055 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.149012089 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.161298037 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.161326885 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.161380053 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.161389112 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.161405087 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.161422968 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.174418926 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.174467087 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.174499989 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.174506903 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.174527884 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.174547911 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186086893 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.186130047 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.186158895 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186165094 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.186183929 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186207056 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186209917 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.186249971 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186289072 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.186312914 CEST	443	49833	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.186424971 CEST	49833	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.435225964 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.435318947 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.435435057 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.435647964 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.435671091 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.525533915 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.525624990 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.525712967 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.525947094 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.525976896 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.526354074 CEST	49836	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:42.767359972 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.767473936 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.767986059 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.768001080 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.769648075 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.769655943 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.827677965 CEST	80	49836	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:42.827812910 CEST	49836	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:42.827999115 CEST	49836	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:42.852848053 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.852951050 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.853435040 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.853483915 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:42.855037928 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:42.855050087 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.085843086 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.085943937 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.108211994 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.108237982 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.108280897 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.108319044 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.108365059 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.108427048 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.108427048 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.129160881 CEST	80	49836	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:43.130424023 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.130502939 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.130510092 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.130558014 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.130572081 CEST	80	49836	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:43.130585909 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.130590916 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.130624056 CEST	80	49836	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:43.130630016 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.130665064 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.130722046 CEST	49834	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.130753040 CEST	443	49834	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.130757093 CEST	49836	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:43.130757093 CEST	49836	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:43.195871115 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.195976973 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.195991039 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.196014881 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.196082115 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.196082115 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.196134090 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.196194887 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.222322941 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.222356081 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.222399950 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.222419977 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.222435951 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.222460032 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.344285011 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.344315052 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.344460964 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.344532013 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.344616890 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.375417948 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.375444889 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.375535965 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.375559092 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.375614882 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.404582977 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.404665947 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.404881954 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.404900074 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.404963970 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.432069063 CEST	80	49836	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:43.492652893 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.492716074 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.492749929 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.492777109 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.492799044 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.492829084 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.513271093 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.513323069 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.513360023 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.513377905 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.513398886 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.513433933 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.534040928 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.534085989 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.534137964 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.534147978 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.534173965 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.534193039 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.556350946 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.556416035 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.556462049 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.556477070 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.556504965 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.556523085 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.579704046 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.579758883 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.579829931 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.579894066 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.579996109 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.579996109 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.599728107 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.599764109 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.599857092 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.599880934 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.599927902 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.617981911 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.618005991 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.618081093 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.618089914 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.618124008 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.652338028 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.652368069 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.652544975 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.652545929 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.652611971 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.652679920 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.665740967 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.665790081 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.665858030 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.665879011 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.665914059 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.665932894 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.680790901 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.680839062 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.680891991 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.680907011 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.680932999 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.680957079 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.696417093 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.696465015 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.696537018 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.696552992 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.696582079 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.696609020 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.710349083 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.710406065 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.710459948 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.710484028 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.710513115 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.710549116 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.722768068 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.722835064 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.722884893 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.722899914 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.722924948 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.722949982 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.735901117 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.735923052 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.736006021 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.736022949 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.736201048 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747606039 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.747675896 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.747695923 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747715950 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.747742891 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.747749090 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747775078 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747800112 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747905970 CEST	49835	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.747937918 CEST	443	49835	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.989542007 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.989634037 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:43.989867926 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.989962101 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:43.989984035 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.070687056 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.071216106 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.071249008 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.071347952 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.071567059 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.071578979 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.323010921 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.323133945 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.323571920 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.323599100 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.325166941 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.325180054 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.367307901 CEST	80	49838	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:44.367424011 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.367619038 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.403317928 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.403633118 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.404066086 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.404078007 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.405833960 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.405848980 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.663443089 CEST	80	49838	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:44.664381981 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.664443016 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.664479017 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.664489031 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.664511919 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.664520025 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.664580107 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.665246964 CEST	80	49838	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:44.665297985 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.665299892 CEST	80	49838	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:44.665339947 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.665368080 CEST	49838	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:44.686534882 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.686594009 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.686665058 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.686676979 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.686717033 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.686718941 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.686732054 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.686768055 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.686806917 CEST	49837	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.686819077 CEST	443	49837	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.743635893 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.743664026 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.743688107 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.743731976 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.743766069 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.743776083 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.743813038 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.770407915 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.770445108 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.770493031 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.770514011 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.770530939 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.770550966 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.891994953 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.892019987 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.892074108 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.892097950 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.892124891 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.892148018 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.923805952 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.923835039 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.923902035 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.923923016 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.923938036 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.923965931 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.952183008 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.952208042 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.952301025 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.952321053 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:44.952363968 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:44.961184978 CEST	80	49838	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:45.040920019 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.040981054 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.041177988 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.041178942 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.041203022 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.041254997 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.061119080 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.061172009 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.061255932 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.061260939 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.061419964 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.081820011 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.081866026 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.082004070 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.082004070 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.082026005 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.082086086 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.104258060 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.104332924 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.104365110 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.104419947 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.104448080 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.104459047 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.127733946 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.127784967 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.127950907 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.127974987 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.128015995 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.128024101 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.147850037 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.147881031 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.148051023 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.148051023 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.148073912 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.148139954 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.166325092 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.166352034 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.166407108 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.166414022 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.166443110 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.166465044 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.200361013 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.200383902 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.200552940 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.200577974 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.200653076 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.213839054 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.213857889 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.213922024 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.213931084 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.213973045 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.229100943 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.229118109 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.229198933 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.229207039 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.229249954 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.244535923 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.244571924 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.244687080 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.244693995 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.244745016 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.258513927 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.258532047 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.258636951 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.258646011 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.258692980 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.270901918 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.270920038 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.271002054 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.271009922 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.271055937 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.284095049 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.284120083 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.284174919 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.284183979 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.284203053 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.284224033 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.295779943 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.295859098 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.295877934 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.295897961 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.295909882 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.295929909 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.295948029 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.296045065 CEST	49839	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.296056032 CEST	443	49839	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.608738899 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.608778954 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.608891010 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.609184027 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.609196901 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.699001074 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:45.699634075 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.699686050 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.699834108 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.710477114 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.710539103 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.935689926 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.935866117 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.936351061 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.936362028 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.937948942 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:45.937953949 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:45.997932911 CEST	80	49841	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:45.998090982 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:45.998234987 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:46.034358978 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.034498930 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.034861088 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.034888029 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.037170887 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.037183046 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.277926922 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.277997017 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.278090954 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.278116941 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.278176069 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.278181076 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.278251886 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.296730042 CEST	80	49841	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:46.298120022 CEST	80	49841	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:46.298137903 CEST	80	49841	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:46.298201084 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:46.298237085 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:46.298305035 CEST	49841	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:46.302038908 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.302145958 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.302264929 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.302335978 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.302335978 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.302335978 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.302460909 CEST	49840	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.302474976 CEST	443	49840	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.377537012 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.377572060 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.377610922 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.377644062 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.377679110 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.377687931 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.377738953 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.404304981 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.404341936 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.404489040 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.404510975 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.404577017 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.525791883 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.525825024 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.525878906 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.525944948 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.525980949 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.526005030 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.557025909 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.557060957 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.557179928 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.557179928 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.557245016 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.557297945 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.586086035 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.586117029 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.586203098 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.586215019 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.586260080 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.597084999 CEST	80	49841	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:46.674309969 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.674344063 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.674474001 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.674489021 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.674531937 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.694843054 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.694864988 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.694926023 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.694931984 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.694948912 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.694993019 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.715542078 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.715564013 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.715643883 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.715651989 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.715694904 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.738064051 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.738089085 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.738204956 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.738214970 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.738255024 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.761328936 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.761352062 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.761428118 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.761435986 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.761455059 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.761471987 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.781294107 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.781325102 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.781404018 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.781413078 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.781455994 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.793502092 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.793551922 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.793612003 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.793617964 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.793641090 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.793658972 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.813260078 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.813292027 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.813358068 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.813365936 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.813386917 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.813404083 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.844676971 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.844707966 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.844789982 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.844796896 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.844836950 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.859889030 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.859932899 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.859993935 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.859999895 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.860042095 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.873713970 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.873734951 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.873809099 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.873821974 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.873873949 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.875575066 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.875636101 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.889611006 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.889628887 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.889715910 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.889729023 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.889796019 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.898127079 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.898173094 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.898200989 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.898233891 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.898266077 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.898284912 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.911358118 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.911377907 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.911448002 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.911478996 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.911537886 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.925167084 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.925184965 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.925251007 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.925262928 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.925302982 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.927015066 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.927072048 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.929081917 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.929136992 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.929141045 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.929167986 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.929178953 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.929198027 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.929203033 CEST	443	49842	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:46.929227114 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:46.929227114 CEST	49842	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.180124044 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.180211067 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.180418015 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.180612087 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.180639982 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.261691093 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.261938095 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.262043953 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.262212038 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.262409925 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.262437105 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.510828972 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.510904074 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.511344910 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.511363983 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.513695002 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.513706923 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.557775021 CEST	80	49844	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:47.557857990 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.558046103 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.587110996 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.587208033 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.587699890 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.587742090 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.589349031 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.589364052 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.852982044 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.853029013 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.853044033 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.853102922 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.853154898 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.853177071 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.853240967 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.853835106 CEST	80	49844	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:47.855258942 CEST	80	49844	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:47.855328083 CEST	80	49844	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:47.855330944 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.855371952 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.855379105 CEST	49844	80	192.168.2.16	52.213.137.28
Apr 24, 2024 14:33:47.877331018 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.877372980 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.877450943 CEST	443	49843	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.877473116 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.877474070 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.877561092 CEST	49843	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.929364920 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.929397106 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.929414988 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.929436922 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.929497004 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.929532051 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.929558039 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.956075907 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.956096888 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.956140041 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.956161976 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:47.956188917 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:47.956206083 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.077672958 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.077735901 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.077784061 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.077825069 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.077852964 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.077873945 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.108839989 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.108892918 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.108937979 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.108972073 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.109019995 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.109019995 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.138247013 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.138272047 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.138319016 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.138336897 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.138365984 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.138386011 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.151504993 CEST	80	49844	52.213.137.28	192.168.2.16
Apr 24, 2024 14:33:48.226109028 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.226176977 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.226227999 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.226294041 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.226330042 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.226352930 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.246645927 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.246692896 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.246735096 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.246750116 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.246783018 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.246805906 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.267280102 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.267323017 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.267368078 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.267383099 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.267419100 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.267438889 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.289506912 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.289549112 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.289592981 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.289608955 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.289645910 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.289664030 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.312937021 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.312979937 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.313024044 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.313039064 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.313067913 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.313085079 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.333126068 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.333151102 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.333209038 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.333245039 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.333280087 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.333302975 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.351377010 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.351418972 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.351475954 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.351491928 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.351524115 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.351541042 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.385447025 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.385534048 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.385576963 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.385592937 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.385634899 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.385656118 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.398806095 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.398849010 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.398888111 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.398901939 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.398927927 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.398947954 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.413978100 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.414022923 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.414078951 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.414098978 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.414124012 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.414177895 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.429641008 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.429685116 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.429738045 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.429775953 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.429802895 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.429843903 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.443666935 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.443708897 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.443749905 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.443763971 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.443797112 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.443815947 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.456062078 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.456118107 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.456131935 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.456152916 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.456202030 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.456202030 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.469194889 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.469237089 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.469285965 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.469302893 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.469331980 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.469355106 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.480755091 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.480799913 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.480825901 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.480838060 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.480871916 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.480890989 CEST	49845	443	192.168.2.16	52.85.39.184
Apr 24, 2024 14:33:48.480894089 CEST	443	49845	52.85.39.184	192.168.2.16
Apr 24, 2024 14:33:48.480938911 CEST	49845	443	192.168.2.16	52.85.39.184

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 14:31:41.980966091 CEST	51335	53	192.168.2.16	1.1.1.1
Apr 24, 2024 14:31:42.274192095 CEST	53	51335	1.1.1.1	192.168.2.16
Apr 24, 2024 14:31:42.611037970 CEST	49158	53	192.168.2.16	1.1.1.1
Apr 24, 2024 14:31:42.794702053 CEST	53	49158	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 14:31:41.980966091 CEST	192.168.2.16	1.1.1.1	0x3024	Standard query (0)	stats.ptinstaller.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 14:31:42.611037970 CEST	192.168.2.16	1.1.1.1	0x19ea	Standard query (0)	d3a6p9a3vksur7.cloudfront.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 14:31:42.274192095 CEST	1.1.1.1	192.168.2.16	0x3024	No error (0)	stats.ptinstaller.com	52.213.137.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 14:31:42.794702053 CEST	1.1.1.1	192.168.2.16	0x19ea	No error (0)	d3a6p9a3vksur7.cloudfront.net	52.85.39.184	A (IP address)	IN (0x0001)	false
Apr 24, 2024 14:31:42.794702053 CEST	1.1.1.1	192.168.2.16	0x19ea	No error (0)	d3a6p9a3vksur7.cloudfront.net	52.85.39.6	A (IP address)	IN (0x0001)	false
Apr 24, 2024 14:31:42.794702053 CEST	1.1.1.1	192.168.2.16	0x19ea	No error (0)	d3a6p9a3vksur7.cloudfront.net	52.85.39.4	A (IP address)	IN (0x0001)	false
Apr 24, 2024 14:31:42.794702053 CEST	1.1.1.1	192.168.2.16	0x19ea	No error (0)	d3a6p9a3vksur7.cloudfront.net	52.85.39.152	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

d3a6p9a3vksur7.cloudfront.net

stats.ptinstaller.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49697	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:31:42.581703901 CEST	589	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWluc3RhbGxlcl9pbml0Jm9zPSg5MjAwKV82NGJpdCZvc19sYW5nPTIwNTcmaWVfdmVyPTExLjc4OS4xOTA0MS4wJnByb2Nlc3NfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImdmVyaWZpZXI9YzBjMThlYWI0ZmI3ZWQ5NmJkMzM3ZGM2YmRmMGNmOTkmdXNlcl9pZD1DNDlGQkU2QjQ1MTc0OEE1QjM2RDFDMzJDQzI5RENCQiZpbnN0YWxsZXJfdmVyPTEuMS4xLjM2JnRpbWVzdGFtcD0xNzEzOTY2NTQ0NDM5JmFkbWludXNlcj0xJnN0YXJ0dGltZT0xNzEzOTY2NTQ0JmxpZmV0aW1lPTA%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:31:42.884119034 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:31:42 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49700	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:31:46.593700886 CEST	619	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU0ODc2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00 HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:31:46.896572113 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:31:46 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49707	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:31:51.743851900 CEST	619	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU1MzkxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05 HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:31:52.046868086 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:31:51 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49714	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:00.445686102 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU2MjYxNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xOA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:00.748384953 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:00 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49717	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:10.986949921 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU3MzE2MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0yOQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:11.284229994 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:11 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49720	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:24.674752951 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjU4Njg0OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT00Mg%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:24.971838951 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:24 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49724	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:40.985210896 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwMzE0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT01OQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:41.287678003 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:41 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49727	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:44.471509933 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwNjY0MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Mg%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:44.768740892 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:44 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49730	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:46.633723021 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYwODc5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02NA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:46.936234951 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:46 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49733	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:48.988347054 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMTE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02Nw%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:49.285571098 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:49 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49737	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:51.046117067 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxMzIyOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT02OQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:51.346201897 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:51 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49739	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:52.653126001 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNDgzMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03MA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:52.955482006 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:52 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49743	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:54.199969053 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNjM3OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mg%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:54.503149033 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:54 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49746	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:55.762123108 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxNzk0MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Mw%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:56.064827919 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:55 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49748	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:57.324212074 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYxOTUwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03NQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:57.624238968 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:57 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49751	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:32:58.903953075 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMTA4NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03Nw%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:32:59.206928968 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:32:59 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49755	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:00.464844942 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyMjY0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT03OA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:00.764537096 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:00 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49758	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:02.039683104 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNDIyMiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:02.339324951 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:02 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49760	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:03.609971046 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNTc5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04MQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:03.910289049 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:03 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49763	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:05.165708065 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyNzM1MiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Mw%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:05.462912083 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:05 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49766	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:06.748646021 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYyODkzNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04NA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:07.045972109 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:06 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49769	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:08.311486959 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMDQ5NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04Ng%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:08.609319925 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:08 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49772	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:09.875869989 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMjA1OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:10.176021099 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:10 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49775	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:11.425098896 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzMzYwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT04OQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:11.725064993 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:11 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49778	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:13.022943974 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzNTIwNiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05MQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:13.320030928 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:13 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49781	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:14.568845987 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzNjc1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05Mg%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:14.866297007 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:14 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49785	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:16.123207092 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzODMwMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:16.425606012 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:16 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49788	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:17.685528994 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjYzOTg2OCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05NQ%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:17.986418009 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:17 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49791	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:19.259633064 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MTQ0MCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05Nw%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:19.562324047 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:19 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49794	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:20.827626944 CEST	627	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0MzAwNyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT05OA%3D%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:21.130290985 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:20 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49796	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:22.380131960 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NDU2NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDA%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:22.679375887 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:22 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49799	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:23.965673923 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NjE0NiZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDI%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:24.268052101 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:24 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49802	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:25.527621031 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0NzcxMyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDM%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:25.824846983 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:25 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49805	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:27.109484911 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY0OTI5MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDU%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:27.409312010 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:27 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49809	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:28.671539068 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MDg1NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDY%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:28.968980074 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:28 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49811	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:30.221255064 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1MjQwNCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDg%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:30.520910978 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:30 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49815	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:31.802103996 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1Mzk4NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMDk%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:32.099137068 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:31 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49817	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:33.368349075 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NTU1NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTE%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:33.665770054 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:33 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49821	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:34.973200083 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1NzE1NSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTM%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:35.273297071 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:35 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49823	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:36.544471979 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY1ODcyMCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTQ%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:36.849920988 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:36 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49827	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:38.115907907 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MDI5OSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTY%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:38.413167953 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:38 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49829	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:39.700566053 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MTg4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTc%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:40.003029108 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:39 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49832	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:41.267296076 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2MzQ0NyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMTk%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:41.569649935 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:41 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49836	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:42.827999115 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NTAwOCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjA%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:43.130572081 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:42 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49838	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:44.367619038 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2NjU1MyZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjI%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:44.665246964 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:44 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49841	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:45.998234987 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2ODE4MSZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjQ%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:46.298120022 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:46 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49844	52.213.137.28	80	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 14:33:47.558046103 CEST	625	OUT	GET /stats.gif?v=2&data=ZXZlbnQ9MTAwJmJyYW5kPVBva2VyIGF0IEJldDM2NSZldmVudF90eXBlPWVycm9yJmVycm9yX3RleHQ9aW5zdGFsbGVyX21haW5fdGltZW91dCZvcz0oOTIwMClfNjRiaXQmb3NfbGFuZz0yMDU3JmllX3Zlcj0xMS43ODkuMTkwNDEuMCZwcm9jZXNzX2lkPUM0OUZCRTZCNDUxNzQ4QTVCMzZEMUMzMkNDMjlEQ0JCJnZlcmlmaWVyPWMwYzE4ZWFiNGZiN2VkOTZiZDMzN2RjNmJkZjBjZjk5JnVzZXJfaWQ9QzQ5RkJFNkI0NTE3NDhBNUIzNkQxQzMyQ0MyOURDQkImaW5zdGFsbGVyX3Zlcj0xLjEuMS4zNiZ0aW1lc3RhbXA9MTcxMzk2NjY2OTc0NCZhZG1pbnVzZXI9MSZzdGFydHRpbWU9MTcxMzk2NjU0NCZsaWZldGltZT0xMjU%3D HTTP/1.1 Accept: / User-Agent: WinClient Host: stats.ptinstaller.com Connection: Keep-Alive Cache-Control: no-cache
Apr 24, 2024 14:33:47.855258942 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 12:33:47 GMT Content-Type: image/gif Content-Length: 0 Connection: close Last-Modified: Thu, 24 Nov 2022 11:21:17 GMT ETag: "637f53ad-0" Accept-Ranges: bytes Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Robots-Tag: none X-Download-Options: noopen Refferer-Policy: no-referrer X-Frame-Options: SAMEORIGIN

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49698	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:31:43 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:31:44 UTC	468	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: RefreshHit from cloudfront Via: 1.1 1c5a7e2dbc29e2ce87f40dbbc168a96c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 8E5--bf4WhbgkHvW1HnEIfK9IXTa5dBun6kUcALAQn-1M22T-HD8_g==
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:31:44 UTC	15352	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: b2 07 76 79 15 ce 32 e7 e4 e1 80 b8 85 fc 74 ac 86 a1 5f f5 15 7a 90 42 47 72 b7 8e 9f 3b 6a 75 94 d9 1d bf a4 71 cd b5 58 22 11 29 40 fc 70 4a ff c9 08 a0 ea 47 76 2f be a5 8d bd 1d 13 c6 24 a6 7e ba fe 66 a6 b1 b2 83 72 9c 2b 16 39 54 4f 76 7a f3 b0 70 c8 f2 ff 8d 05 c0 73 3a c4 db 90 16 0c d1 59 fd e9 07 79 f2 90 2d be 21 7d 90 d3 ee 82 fb 23 97 40 70 35 b9 c4 93 61 b6 c6 57 ff dd 65 83 08 56 7b 11 22 ff d8 a1 95 6a f7 47 1a 09 f9 14 a5 79 6e fe 2b fb f1 78 cf 6c 98 d7 79 79 e8 1f e5 07 d5 48 c1 a4 89 d5 4c 6f 8b 6c a6 41 6e 15 b7 18 0a 7f 21 df 19 e2 75 ae c2 16 7e f9 d6 fb 9b e7 6f b6 c5 87 f4 53 d8 4d 81 67 d5 5d 75 fc df ac 29 8e 2a ed d1 ad 62 ac c3 72 c5 28 44 ed d4 7a eb fb f8 0b 98 48 8b bf 7b 7d f8 4b ed 71 b5 fb 9a 34 ff e9 48 83 d4 da 23 22 Data Ascii: vy2t_zBGr;juqX")@pJGv/$~fr+9TOvzps:Yy-!}#@p5aWeV{"jGyn+xlyyHLolAn!u~oSMg]u)*br(DzH{}Kq4H#"
2024-04-24 12:31:44 UTC	16384	IN	Data Raw: b1 c2 23 72 9a 5f e5 2d 70 80 94 7d 80 cb 55 9e 2c 87 b1 24 30 5b 6f 46 91 ee 70 c3 20 72 1a f0 31 f9 ab 62 59 d1 f3 0f 2f 1f c9 3c 3f c4 81 28 55 a4 34 80 3d 82 fb 8d be 05 19 87 08 c4 68 b7 bc 5a 92 c6 96 89 ff 4d 8f f1 43 87 e9 72 c3 42 9d 70 8f 28 99 f3 7a 8f 54 8a 7f 06 04 e9 84 ee db 97 d7 09 a6 8c 8f 0f e6 34 5c b7 86 00 3b c4 25 af 74 82 46 02 5f 9b d4 39 1d ba 71 fe 84 0e fa e4 07 24 0f 32 8e 5f 4b 13 34 ed 9d 9c cf fb 73 8d f3 81 8b 68 fa cc 6a 86 c1 0a 35 1a aa 78 f5 40 cb 82 75 84 35 13 15 6b 86 ca dc 17 d9 dc 16 d8 0e ff a3 fa c7 05 8a 05 05 81 81 9e 1b b4 ee ac a5 6a f9 fe c8 68 94 7a c8 55 25 8f 06 4f 33 05 51 f2 3a 38 72 3f 6d a9 b9 d2 35 6d 38 ef 0b a9 8f 5a 5f a1 c8 3d 4a 4b a8 ce 49 45 bc c3 e5 2e 38 fb 55 48 aa 42 a8 f9 e9 ac 29 0d fd Data Ascii: #r_-p}U,$0[oFp r1bY/<?(U4=hZMCrBp(zT4\;%tF_9q$2_K4shj5x@u5kjhzU%O3Q:8r?m5m8Z_=JKIE.8UHB)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49699	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:31:46 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:31:47 UTC	461	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 2d00df3f936d7626d50853ebd0e73b30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: fWEaMAUpJmG4XR8wXlGbb8nD7in0eJkF2iil775D6cF5XQyr2JjBIg==
2024-04-24 12:31:47 UTC	15923	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:31:47 UTC	67	IN	Data Raw: 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 Data Ascii: +,6\|} yC=>'ZNXNtw97t6q
2024-04-24 12:31:47 UTC	1512	IN	Data Raw: 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 cc 3c 10 89 d0 e6 c4 9d 79 9e 73 ab 1c bf fb 5a 13 93 81 95 6f 5e c9 1d c0 1f 30 13 62 09 49 df f2 50 32 27 f5 95 79 01 0f b5 6c 0f 05 93 ec b4 e8 bf 0c 6f 58 40 2d af 86 75 97 2a 18 aa fb 38 6b aa be 96 87 7c 28 8b e9 58 fd Data Ascii: ;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS<ysZo^0bIP2'yloX@-u*8k\|(X
2024-04-24 12:31:47 UTC	11620	IN	Data Raw: 24 3e c8 6c e8 f8 c9 98 ba 3c 78 3a 97 47 ed 2d a5 07 7b 86 ac 39 38 2b 0e a7 de a4 46 54 3c 04 50 07 55 13 6a ff 68 b1 c8 4f e5 a4 87 10 6d 44 e0 1d c0 34 a7 75 81 8f cf 82 d2 0c 79 a4 79 6f ec 2d 4e cb 43 69 76 f5 b1 55 94 6b b9 9c 1a e8 3b 6c 84 a1 e7 60 40 10 3c 71 e9 74 2b 89 e5 96 27 0a dd e6 3e e8 80 68 9e 54 65 dd 05 18 90 32 64 fb 20 1e 6c 50 d1 7f a9 a0 f9 3a b2 5a 8f f4 18 00 ee cc d2 1f eb a3 38 6d 87 19 62 82 ff e0 eb 2e af b4 2e 0b 02 be f3 8d 7c 92 9c d2 cc 31 8b 7e d8 f4 84 97 09 fa bd 1f fa e8 9b 92 3e 84 2f 4b a7 28 b7 a3 c0 bc 51 a2 c0 85 6c 84 a2 e5 bc 6b 1c d4 fa d5 6d 99 f6 ab 57 fc 5b 69 9c b3 80 dc 11 20 e3 2c f9 0c f5 c5 bd 42 a2 e7 ab 7f 30 91 5c 71 6a bc fc 4e 19 45 06 d0 ec f7 02 26 dd 4e 7b 1f 83 e5 2a 47 d8 84 bb 64 05 9a 46 Data Ascii: $>l<x:G-{98+FT<PUjhOmD4uyyo-NCivUk;l`@<qt+'>hTe2d lP:Z8mb..\|1~>/K(QlkmW[i ,B0\qjNE&N{*GdF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49701	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:31:46 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:31:46 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 029709435e1da82d2fcf38cfaa581f38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: EwOCBy8-s7WXhTOv6kmVF15G6Ici56xreKgkiMJbxPjvdZ3WvysFkA== Age: 3
2024-04-24 12:31:46 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:31:46 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:31:47 UTC	11610	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 16 6f f4 50 a1 aa 49 3e b7 94 f6 78 a8 d9 fa fe 1a 19 cb 53 80 ec af 03 5d 11 b6 a1 97 5f a1 cb 33 d6 e4 ff 23 7f 21 a6 01 6c 98 57 48 5b 72 de 3d e9 30 73 83 4f 9a d0 49 df 3d b7 32 ed aa 90 fa 46 77 13 f6 78 61 e5 8e 2b b5 fa 36 9b d3 b2 04 dd 2f 85 4a e5 b5 0e d9 c2 1c 37 36 ed 3d 67 64 de 2f 62 9e 7f 68 3b 80 c5 5e f7 4c ec ab 5f 1c eb 2b 8f 4e 6f eb 8c dd 47 68 e3 b4 30 ef 84 39 96 ad f1 9c ca 21 8c 51 8a e5 44 90 13 ea c9 3b 48 eb df 2a 53 30 42 d5 d0 3a 29 7e f9 b3 15 97 e5 38 9d c7 a6 44 ea 10 09 25 e1 85 a2 b4 f6 8d 21 71 c8 62 b1 36 7e 8b 98 35 db 91 e9 cc 83 85 7c c2 34 e7 b6 10 62 18 a4 af 31 9f b3 0e a5 cc af 25 0c c5 9c 54 bb 31 30 1b 7f d4 b7 5f f0 de b3 e5 a5 d1 e5 5c fa f4 1c ad 86 34 56 b5 71 40 42 8d cb c7 b1 61 75 0e 6a 8b f1 28 6b cb Data Ascii: oPI>xS]_3#!lWH[r=0sOI=2Fwxa+6/J76=gd/bh;^L_+NoGh09!QD;H*S0B:)~8D%!qb6~5\|4b1%T10_\4Vq@Bauj(k
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 4f e8 ef 31 d9 54 0b cc 50 65 0c 7e 4d db 24 38 11 cb d3 c9 40 7b 0e 8f 0d 8e 65 9d 45 49 4b 07 39 95 54 11 f1 31 d1 ca 3b 9c 04 7c c8 d2 32 51 c3 db bb 18 11 96 01 9a 32 fe d8 98 2a 87 a7 aa 7a 56 bd da 85 48 58 e0 a9 07 2e a7 c4 45 12 57 a5 ec 9c 46 02 16 8b cb 83 5a 9c 29 5f 18 a7 58 0a 18 01 6f e6 9d 8e aa 84 f4 54 f2 f1 79 ab 04 ca 18 40 3a 12 5b f3 1a ad 7a a2 63 9c c6 e9 c9 2e ed 7e 4d d3 db ac 2d 72 a8 20 cd 63 e7 68 d1 d0 53 6b 7e 05 32 f1 25 e3 e6 81 44 99 e0 22 2c 1a 39 25 21 54 79 7a d7 3c 9f d1 50 9d 13 99 43 e4 44 dd c9 a2 b1 45 ff 3d 48 46 d0 de 06 9c 11 e8 32 3b 3c ee c4 1c 9d 72 ac 1b 8c fe dd 5a 42 c0 a1 68 bb 67 bc e0 c6 ff 77 d1 cc 15 5c 0e 1f 96 19 e1 01 c7 a5 96 3c f8 bf 23 43 74 e5 ea 50 41 ef c0 a5 65 7c 41 19 6b 38 9e 7c 52 da ee Data Ascii: O1TPe~M$8@{eEIK9T1;\|2Q2*zVHX.EWFZ)_XoTy@:[zc.~M-r chSk~2%D",9%!Tyz<PCDE=HF2;<rZBhgw\<#CtPAe\|Ak8\|R
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: aa cb ec 28 21 6a 02 ad e0 20 b5 33 2c b0 66 c1 ee 11 59 6b 7a 35 7d 80 d2 cc a4 2d c7 15 59 50 32 7e d4 77 ba 32 d8 ff 36 ce c8 37 30 ca 73 ca 2c 7b be b1 22 46 4d a9 aa 7e 99 63 51 ea 1f d0 b1 11 38 99 16 49 9e 07 f0 06 d7 df 10 6f f5 23 65 c0 73 f3 ce c7 a1 4f f9 66 40 17 f4 a1 23 31 7f 28 28 20 d1 26 06 05 3a 89 06 5d b6 ad 4a 27 a4 e3 32 53 98 77 2a dd 7e 8d 98 a6 68 d4 16 8a ff c3 a1 00 41 30 1e d2 5a 67 13 e9 af 5f e6 fc 3c ec 33 8f bb 7a 02 d3 85 37 da 64 ca 70 13 05 de 63 d1 ed c8 c1 54 d6 b3 7b 5d 7f a1 c5 0e eb f5 c3 09 39 6f 29 dc 2a 4f a0 b5 7e ef 99 21 2e 28 9e a2 c7 f6 ec e1 a1 08 0f 8c 2f 83 94 65 13 5e 85 79 eb cc 2a 7c 2b a8 da b0 e3 77 ee 22 47 13 2b 17 17 5e f2 9a cd 23 26 ce 21 13 a2 1e 3e 07 1c 7c 4e 3f 69 92 25 a8 0c 1a 4a 09 6c 3e Data Ascii: (!j 3,fYkz5}-YP2~w2670s,{"FM~cQ8Io#esOf@#1(( &:]J'2Sw~hA0Zg_<3z7dpcT{]9o)O~!.(/e^y*\|+w"G+^#&!>\|N?i%Jl>
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 14 53 c3 fb da e6 a5 8d aa d9 d4 c4 33 62 26 79 a9 f4 81 4a fc 29 69 e7 6a 50 0f 9d 49 58 97 eb 8c ee 05 21 b1 d9 e3 03 16 cd e3 35 e3 bc 19 ab e5 45 a6 ee a2 b4 c0 21 04 9a 04 87 b5 91 d5 33 3a fb d8 9e 67 a9 e1 bc ec a3 d0 f0 d3 ed ad 51 b1 2f a4 d5 19 73 ac 3d 89 81 7e 3a 53 06 95 88 c2 c0 61 ca 58 9a 16 17 c4 e9 5a 28 15 3f f5 91 38 64 98 f1 d2 73 4d 0a 0a e4 33 a4 e1 5d 82 21 66 56 af ae dc 43 4f ed f4 f7 8f 05 79 6d 13 19 1f 41 82 cd c7 d6 6e c9 db 20 41 a2 2b e0 cf b9 e1 71 76 51 b2 6b eb ab 37 a3 ad 97 8c 0c b6 aa 12 cd b9 85 85 36 b2 60 0a 39 0e 0e 30 57 fe a1 17 9a bd b5 32 98 62 53 b4 ba 92 b5 41 88 73 24 24 12 57 24 fd c7 8c 18 5b 61 2c 81 3b ba 9e 2d bf 6a 26 a0 36 2e 43 58 fb ee 17 e9 54 08 4c d3 85 7f 83 d7 36 29 65 96 f1 f6 20 aa e1 23 0d Data Ascii: S3b&yJ)ijPIX!5E!3:gQ/s=~:SaXZ(?8dsM3]!fVCOymAn A+qvQk76`90W2bSAs$$W$[a,;-j&6.CXTL6)e #
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 1e e1 07 6d a4 75 21 10 f4 49 66 6b e1 d5 62 b0 0a cb 31 1f 25 6b d1 65 3f c9 d2 22 dd a2 50 34 1d c2 5d 37 45 7a b6 9d ad 12 6d 20 72 86 f9 a6 26 4b e5 31 12 ee 20 aa 0d 5d b5 2f 4b bf 2c 7b 2f be 44 c9 95 d3 ba 0e 1a 43 e6 86 b9 d0 43 94 57 a0 2e 86 30 a1 17 d0 ae e0 5b 31 4a 57 50 c0 db ee 33 c4 e9 05 be 96 5d e6 7c 46 86 53 23 eb 01 22 34 cc 78 30 1a f9 cc 75 1f ad 4a 2d 4d 45 e3 4e d6 9e a8 f3 91 a1 97 04 2d fd f1 31 3e 9b 78 3b b2 d4 c2 2b 24 32 54 47 29 50 2b 95 63 c4 4f f9 b7 c0 be 10 99 ad f3 73 f3 e8 77 7c 83 65 29 cd 8b a1 d8 78 e2 6b da ac 4a 0d 86 eb f5 16 6b 87 b1 19 4d 5b bf b9 8d 1b ce 6e a2 96 20 7d b7 c7 01 88 c2 55 5c d2 ef 68 05 03 04 f4 1c dd 20 47 59 92 7e a9 92 88 28 98 4a 01 a5 b2 42 cc 8a a0 04 e2 5f 94 77 0e 88 48 f9 36 60 25 7d Data Ascii: mu!Ifkb1%ke?"P4]7Ezm r&K1 ]/K,{/DCCW.0[1JWP3]\|FS#"4x0uJ-MEN-1>x;+$2TG)P+cOsw\|e)xkJkM[n }U\h GY~(JB_wH6`%}
2024-04-24 12:31:47 UTC	16384	IN	Data Raw: 65 ed 62 0b ba 28 b1 75 a6 21 0e d1 c7 40 1c 8f 43 4e 14 fc 87 e1 77 13 a5 5e f0 05 f6 c6 43 7a 9e 95 9c 62 3f ca 92 4c 17 61 96 e7 22 0a 8d 2f c4 ea 80 f4 23 ec 55 bf 92 b9 83 52 e4 0a 9f 55 0c 78 f6 cc 4b 8e 7c f6 84 10 d9 95 64 2d 9f e7 e1 35 8b 67 e0 f1 75 6c 39 c9 c6 61 d9 20 ad 42 a3 3c 22 c3 93 a9 46 98 50 3d 16 71 00 a6 c5 ab cb 07 93 02 e3 72 28 ee c9 f9 74 03 a4 0a ac a0 99 17 3c cc 0b 8e 9b 5d 0e 81 b1 4e 34 c2 86 fc a2 5a e6 42 64 ac 6c 15 7a fd a4 c1 36 be 66 ba 0d 04 f0 4c ef 27 78 93 df 62 91 7a 34 1b e2 3c 5b 01 ed c5 90 86 28 d3 88 ad 4f ec 9e cf cb a3 0d 03 28 00 c1 a6 d4 4d d2 9d 09 b9 17 22 8b 9b d0 6b d5 5b f5 0e b8 a5 2f a3 b0 e5 4b a8 c0 23 bb a3 58 cc 36 48 e8 9e de f5 b0 c2 ab aa 40 3d bb e0 cd 93 4d a3 b9 d5 65 9e 0d b1 32 58 8b Data Ascii: eb(u!@CNw^Czb?La"/#URUxK\|d-5gul9a B<"FP=qr(t<]N4ZBdlz6fL'xbz4<[(O(M"k[/K#X6H@=Me2X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:31:51 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:31:52 UTC	468	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 8e2ab8d4ebdf363d2c4ab61a7cc5bc34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: FnXD9dW7amBq0BSNYpHntrDjqqStDzHjgDqSL3pnp8Dluh7yEQh9ng== Age: 4
2024-04-24 12:31:52 UTC	15916	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:31:52 UTC	13206	IN	Data Raw: fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 cc Data Ascii: =+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49708	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:31:51 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:31:52 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 567a2d2f8a3ac0cb43e8d4a0bb1bd63c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: p2U71g9I-481mZoqcfG93o-pvMiP0n1OzF8_t5qS5DhYp9G2CXK4Dw== Age: 9
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:31:52 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49713	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:00 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:00 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 567a2d2f8a3ac0cb43e8d4a0bb1bd63c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: bDJvARsCBQC9_ijfBSBTwdLYQavGwFGQX0-o16rDSUXpkL-eb-3ShA== Age: 13
2024-04-24 12:32:00 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:00 UTC	12398	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=
2024-04-24 12:32:00 UTC	340	IN	Data Raw: b3 36 da d4 7e af 3d b3 cc 25 17 18 56 c0 e6 0e c8 9b ff bb a3 9e 5d 60 18 9c 66 f5 96 6f 41 22 36 63 d3 be 72 fa 55 ed a9 fd 53 f8 5c e8 3b c8 ac 69 65 28 dc f1 7b a5 91 40 80 d2 64 4e dd 1b 13 57 ad fa da ec 30 89 56 07 b9 60 ce d8 a2 74 95 55 75 aa 26 c6 d7 5f 43 37 72 d9 fe 16 89 9e 8e df 06 ea bd 2c f6 fb 6f aa 55 77 6a a5 92 41 fd 9a bf 12 fc b9 3c 2f 91 e5 c9 60 dd b6 0b 29 e1 76 52 28 3c 47 38 38 50 37 7c 45 f1 36 95 19 79 51 09 41 d0 08 4d a3 c1 52 38 d4 33 18 24 58 ca bb 54 95 04 0e 7c 83 74 ff e2 53 fd 06 31 57 77 03 a8 48 a9 8c a8 72 f8 f4 33 6a 2b 8c 7f bd ca de 29 2c 90 0d d9 75 63 69 6d d4 b7 fd f6 79 be c6 03 a0 fc de 6a 77 61 c2 f4 c7 56 79 62 e8 d6 36 a2 10 ed e5 f1 01 1e ba bc 44 8d cf eb 49 e4 11 91 f5 37 7b b0 06 3b eb 1d 32 d5 fb 60 Data Ascii: 6~=%V]`foA"6crUS\;ie({@dNW0V`tUu&_C7r,oUwjA</`)vR(<G88P7\|E6yQAMR83$XT\|tS1WwHr3j+),ucimyjwaVyb6DI7{;2`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49715	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:00 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:00 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 67457a1c6fa65adb25b9c8de1fddc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: dNfUN2uRPWdBJwQAl_jrIsclgszHtESZ29SijojHWn7Skovrdq9Jpw== Age: 17
2024-04-24 12:32:00 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:00 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:00 UTC	2410	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:00 UTC	16384	IN	Data Raw: 4c b1 24 a4 23 82 f7 0b 18 20 39 c7 01 0b 80 d3 98 19 d7 9d 19 4a 18 d6 3f 17 80 be 7d 5d 8c 82 65 92 dd bc 77 8a 12 b6 03 41 b1 32 91 9c fb 09 09 e2 db 88 14 ac 24 52 9e ac 59 b5 09 bd 9c a0 39 82 4d 9d b2 fe 20 0b 0a dd 6a 8c e0 f9 97 65 30 99 55 41 02 8b 2d 87 1a 3f c2 37 8e 98 1d 86 f9 c7 04 7e 76 24 2a a0 a4 ed 3b 08 69 0b db 81 55 69 d6 1a aa f5 63 f7 6a 07 35 da d0 34 3b 90 22 de 11 ac f7 a8 ec d7 f7 c8 60 0b 64 ff e1 e9 f9 52 e4 bb ae f8 32 1b bf 54 f8 66 bc 58 76 f3 3d cb 2c a6 4f ab bf 53 0f 19 e9 ea 23 a3 21 14 c6 bb 40 9d b9 61 cb 83 b6 f2 a2 67 92 4c ef 0d 18 55 f0 8c d2 ad c2 39 7c 84 20 e6 f9 c2 b0 23 a9 01 bc 14 ca c5 b0 27 16 1c ee 62 e6 8e 06 d0 0f e5 51 1d f9 5d 1a 29 f7 1d 5d b0 9d f1 d7 2b 83 57 c2 7d 28 98 8e 03 2b e3 f6 95 e6 8c 71 Data Ascii: L$# 9J?}]ewA2$RY9M je0UA-?7~v$*;iUicj54;"`dR2TfXv=,OS#!@agLU9\| #'bQ])]+W}(+q
2024-04-24 12:32:01 UTC	12942	IN	Data Raw: ad 99 d9 aa bc 63 5f a5 90 74 95 d2 44 ec ab 4c d5 93 64 d4 9a cb 70 2b 9f bd 82 0f 09 29 ca aa b1 c2 9b a0 74 67 11 60 4d 16 d3 6d 94 5c d4 16 e7 e5 3f b2 07 08 ce 77 16 c0 44 ac 5a 26 aa 23 85 fa e9 1c e7 7b 49 4f 4b ee a0 b2 2a a3 e9 e1 5a 13 69 41 cc 90 8f d6 af 91 2a 72 d6 9d dd 44 68 b2 62 52 54 ff b7 d3 e0 fd 6e 9c a9 f0 b0 af c0 33 1b 4f c7 9d d3 42 7c db 4f 8e 90 77 2a 52 dc 13 19 54 9b 41 a2 d8 d2 43 69 16 23 05 f4 f2 2e 5a c6 a3 99 f7 dc cb 9f 82 73 d4 87 0f b3 be b4 56 4d 14 a8 5f 76 de 62 dd d7 bd 29 77 89 b6 61 38 94 89 ea a0 e9 fa e5 f8 b7 32 0e 2d 59 76 f6 8e d3 5b 15 b1 0e ef b6 7d fc 94 f9 81 e4 56 db a7 11 7f 59 6f 5d 87 cd c6 b1 51 1a b2 3b 27 a1 a5 c2 e5 60 3b 70 ef 1b 82 ce 7f a2 5b f9 27 19 34 79 5d ad 77 b6 56 e0 05 65 2f 37 d2 d1 Data Ascii: c_tDLdp+)tg`Mm\?wDZ&#{IOKZiArDhbRTn3OB\|Ow*RTACi#.ZsVM_vb)wa82-Yv[}VYo]Q;'`;p['4y]wVe/7
2024-04-24 12:32:01 UTC	16384	IN	Data Raw: f9 34 f9 a3 30 dc 71 6c 86 a0 cc ed 62 be 4a 51 6d fb 91 9d 2f 2c a7 b9 c0 8d 7b b2 4d b2 f1 ff 61 d1 c6 21 1f f7 81 1c bb 83 2b 9a 36 37 e9 0f e8 ff f4 15 a7 e2 46 59 c7 05 65 7d 51 5f 8f 15 3e df 74 6b 29 b8 57 74 de 90 9d 03 7e 21 1c 2a 3c 34 35 b0 63 0a dd 34 66 8a 57 4a 52 ea c9 a7 47 79 26 80 94 fb 86 1e 14 ef 72 bc 50 99 75 1a 23 21 31 b4 a2 03 7f 61 c7 f2 e4 60 7e 9e 06 86 92 8b d8 03 cf 33 a2 90 37 58 2d 3f aa dd 9b bf fe 0f 0f 44 48 77 29 4f 32 e7 66 cc e0 66 c7 ee 9e 55 30 cc e3 69 5f 7b 63 6d 28 53 1b 21 b0 05 a4 7e 1e 77 45 ba df 24 28 ed 78 69 d7 5e 22 13 53 1d 35 40 7a 20 47 86 81 ea 26 0b 4f 36 71 5b fb 1f 1f f8 7c b8 df b4 22 d9 37 4d 88 31 0a 3e 3f dd b5 53 4c 4c fb c4 1d 59 af 12 8c 0e ee 68 42 29 40 dc ad df 85 e8 99 7b 9f e6 ac 3b 92 Data Ascii: 40qlbJQm/,{Ma!+67FYe}Q_>tk)Wt~!*<45c4fWJRGy&rPu#!1a`~37X-?DHw)O2ffU0i_{cm(S!~wE$(xi^"S5@z G&O6q[\|"7M1>?SLLYhB)@{;
2024-04-24 12:32:01 UTC	16384	IN	Data Raw: 9b 60 bc 35 c3 e8 93 11 7b 31 34 77 8a 45 0b 90 cb 36 68 bf 57 af 0a 43 f5 dc 2f 39 1a 91 61 0c 92 39 ed f5 a3 b1 4f 6e c9 d9 6f c9 3d 9b 01 cf c2 10 49 2b 9e 32 1b 7e 79 68 c1 3d de 3e 0c ae 61 a2 15 e8 64 27 6e 37 4a bd 72 e2 98 32 4d 87 3e 94 08 95 83 a9 61 34 2d 5b 14 16 18 98 e3 45 f8 68 b2 68 b1 41 21 a9 04 e8 f4 49 89 76 e7 fd e4 af ca 9c a5 81 43 77 2d 0c 59 19 b8 1d 98 66 15 19 28 1e 7f fa 26 ca 23 a9 4f da dc b7 9f 50 b0 e3 08 ff e4 c5 9b 42 7e 0e f6 df 73 d2 25 73 ec f2 76 ef 49 96 91 46 5d 91 52 a8 80 c5 08 a7 be 05 e2 61 1a 96 2c 90 df e3 bc 8c 2e 97 2d 10 07 76 59 e7 5c 4c 77 da ca af 58 03 8f 2f 21 5d ea a3 a4 4a 36 a7 53 f5 bd ea b2 16 9d 42 b2 d0 59 74 2e c0 4b 3f 53 b9 38 f4 57 4d 77 8e f9 fa 18 b2 80 a9 e6 c2 e6 de b8 a0 7c da d6 db 55 Data Ascii: `5{14wE6hWC/9a9Ono=I+2~yh=>ad'n7Jr2M>a4-[EhhA!IvCw-Yf(&#OPB~s%svIF]Ra,.-vY\LwX/!]J6SBYt.K?S8WMw\|U
2024-04-24 12:32:01 UTC	5608	IN	Data Raw: 38 08 06 72 46 c8 27 5e 14 8a 5b 9e 09 2e b5 56 a5 a5 fc 78 97 bd 3d 9a 7f 0c 5e 1d 30 f5 5d 89 8e 97 b6 69 0e 7d e5 9e a6 c4 11 4b e4 8b 98 57 b4 c2 04 77 be 48 4b 96 f0 6e 99 95 e3 10 3d 63 1c 9b 16 62 58 90 82 fc 7f 7e 18 7d c1 16 e0 66 94 f8 2b ed 19 1f 8f 83 c1 ce 50 30 8d ac 3c 89 9e db 3e fa a6 ca f6 d2 d6 58 7c 01 b3 0c 72 02 24 e4 15 05 53 ad e9 7c 02 91 c4 04 e3 e6 e2 a3 b8 0f 99 3e 0c 42 6a 34 da 9f e5 29 5c 98 e7 6c 65 c5 8b c0 90 97 80 1d e0 0b cf 12 42 db 88 6f 90 38 e8 73 31 55 0b bd 01 e5 58 45 da 7a 46 84 e9 4a a5 17 98 ae f5 67 fb 3a 9f bd 5c b5 02 3f f1 e0 5d 29 dc 8d cc b1 f2 1a a4 42 9e 02 ac 87 4a 86 e9 f9 c4 a8 c3 6b 98 57 de d9 ec 64 cc 04 b7 e6 bb f3 7e 20 58 a8 31 65 c2 71 67 6e b0 21 a0 a6 92 fd b2 4e b2 a7 a4 09 58 1e fa 00 22 Data Ascii: 8rF'^[.Vx=^0]i}KWwHKn=cbX~}f+P0<>X\|r$S\|>Bj4)\leBo8s1UXEzFJg:\?])BJkWd~ X1eqgn!NX"
2024-04-24 12:32:01 UTC	16384	IN	Data Raw: e3 e8 da 53 3d 1c d1 7e 9d 89 c8 5c 09 76 b2 7c 9a bd ad 50 df fa 37 13 40 bd 2c c3 f7 fe c1 43 03 f2 7e 66 73 d5 0d 39 0d 6e 1c bc 61 3b 78 1b 54 27 c5 34 b6 cb f3 92 4d 2e 82 a2 7c c2 c0 7b 37 40 83 73 d0 f4 c7 d4 35 d2 44 44 2c 34 74 e9 93 00 99 83 28 76 ed 5d 21 5a 25 0a 52 fc 7f 1f f4 92 a7 55 92 0c 02 9e 0b 53 79 ac 09 57 de 09 0c 9b ce d0 9f 20 a4 d7 7d 7a 5a a3 b3 a8 d4 f5 ae b5 a3 7a 27 72 6e 60 56 15 08 86 d4 98 72 dd b5 4f f1 f5 5e ff dd b2 13 a1 67 38 aa 0a 5f 71 e7 d5 f7 23 06 5d 32 af 79 f8 11 8a f9 55 8b 05 8e 91 1d 50 07 88 3f 4f 0f 88 82 a2 f8 99 ad a8 f7 6f 67 51 02 7c 5a 8b 11 28 1b dd b6 c8 b6 85 8e c5 e9 8a 53 23 46 f4 17 be 66 d5 6a 5c c8 d0 92 74 87 f2 19 56 7f 92 46 4e 53 7e 07 6c 7b 4a 07 22 3b 1f be f2 2d 20 b6 c7 29 7c 2d 2f 31 Data Ascii: S=~\v\|P7@,C~fs9na;xT'4M.\|{7@s5DD,4t(v]!Z%RUSyW }zZz'rn`VrO^g8_q#]2yUP?OogQ\|Z(S#Ffj\tVFNS~l{J";- )\|-/1
2024-04-24 12:32:01 UTC	16384	IN	Data Raw: c4 0a 27 a8 5d 1a 40 15 6d f9 53 68 ca bf ff ce 45 63 e7 20 e0 5d 0c 66 cb 15 11 3d c2 0d 28 b5 68 89 82 ed 4e bb 8e 04 02 7f ae 30 ca 7a 5a c9 bf 4b 55 0f d1 d7 59 ff 4c bc 0a d9 55 fc 34 fc e7 33 36 45 24 3c c9 bb 95 8c a0 64 93 a7 62 85 c8 5b bf 81 bf 84 68 cc ad 7d c3 6e c0 67 92 1e 69 09 0a 6c 63 12 5a 28 12 a4 57 50 bd c6 14 97 a1 c4 54 06 e7 2b ad 0e be df 84 df 62 79 7a 87 95 38 b9 53 b5 70 00 8a 5f 5a 03 cc 0e 44 32 fd db a9 6e e3 05 87 18 70 39 50 bc 28 8e 6b 79 3e e5 71 ba 8c 5b b5 ef 17 81 0b 51 e0 ec 61 ac 5c 5a d2 2a ae 92 cb 63 5a 20 a7 5d 37 9d ea 64 43 7f 57 2d 4f 70 b0 f2 fa 8e c0 9a 46 fb 5f 28 7d 5e b4 27 8d b8 58 19 c0 b0 af e1 67 69 f1 ab 9e 13 16 37 0a b7 80 3b 82 ac e9 4d 6f a7 97 0e da c2 dd dc 01 c4 03 21 bb 04 41 86 39 56 d0 e6 Data Ascii: ']@mShEc ]f=(hN0zZKUYLU436E$<db[h}ngilcZ(WPT+byz8Sp_ZD2np9P(ky>q[Qa\Z*cZ ]7dCW-OpF_(}^'Xgi7;Mo!A9V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49716	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:10 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:11 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 81c9c18fb33769240d77079676b28890.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: KVJciE-AP007iIQHHnPg_Q3sMIzE6wTBISjaFBmUtG_wigT4AFd5sA== Age: 24
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:11 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49718	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:11 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:11 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 567a2d2f8a3ac0cb43e8d4a0bb1bd63c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: dG3buWS0oqV48wxIIImhFBBKNq5w4hS24QyOkSi042c2difOa_m-CA== Age: 28
2024-04-24 12:32:11 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:32:11 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49719	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:24 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:24 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 3OZQkKa2jo4He81MhslElh8l-UD3WbAv6EfvDBvDFG4SbuZvO7iGKA== Age: 37
2024-04-24 12:32:24 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:24 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49721	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:24 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:25 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: rXPgHRvwrHCtU7yAlAiiW-ZJ2JU4538MkNIwk01-C-BMre53rxsvQg== Age: 41
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:25 UTC	14808	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: f5 3e 47 00 19 25 28 7f a4 d5 7e ee b0 7c 5e 8c 31 cc 73 99 eb b6 e9 c6 14 37 41 5b b3 d2 f5 cf 36 dc 31 8f b5 bb 88 7b 71 b7 12 ec 2c 7f cc 61 f8 dd bd a0 16 90 fd c8 35 63 91 12 30 90 59 74 b7 30 2c a8 9a 70 41 e1 bd b1 28 f3 d5 17 e8 2b 14 66 3f 51 ab ff 71 7a e6 17 9a 54 52 de 82 33 f1 3d 0d f4 f8 6b f2 a8 3e fa c6 96 0e 59 4a f4 da 70 f2 7a 36 3b c7 23 f3 d3 ca 86 63 6c 0a 6a 6e 33 e9 8c 56 9c 3d bf 86 83 35 08 d5 6d 48 d8 11 43 51 2c ef 78 3e e9 4e c7 30 43 aa 7f 7b 75 a7 32 cc c8 f7 ae 9b ac 53 8b 93 37 16 54 d9 46 ad 0c 1e 6d 00 f6 b1 d2 38 42 c2 11 ad 63 2b 30 cc f7 98 a0 66 ab eb d5 f4 74 e4 81 df 9a 6e 25 3d 17 9e c5 d4 27 c9 84 6d 70 4e 9b d6 95 09 22 b7 72 7b d4 dd 9d d2 a4 57 7a 19 7f 02 85 31 de 3c ac b2 0d d0 65 4f 99 3f d7 93 dd 61 08 8f Data Ascii: >G%(~\|^1s7A[61{q,a5c0Yt0,pA(+f?QqzTR3=k>YJpz6;#cljn3V=5mHCQ,x>N0C{u2S7TFm8Bc+0ftn%='mpN"r{Wz1<eO?a
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 23 06 be 46 77 13 75 06 f7 7c 22 1b e5 e7 99 04 7c e6 e4 ef 80 09 08 f2 55 10 a8 83 6b 35 0b 45 55 83 ef 73 7c 68 92 4b 9f be 94 cd fa 00 f1 68 26 26 eb 59 3d bb e2 38 22 94 68 48 11 2f d6 b6 5c 44 eb 5b c9 73 13 6d 6a ba 58 07 f3 6e ef 07 2e 41 dd aa 91 13 a1 68 b6 89 f1 c2 5e 63 79 90 3e 0d 1a ca 40 b9 29 4c ed ed f9 9d 2e 4a 02 ab 68 c3 6d 4b 10 ec 08 ce 6e fc 51 60 68 04 2c ca be 40 61 b0 81 62 fa 11 f8 db 53 5e 0d c8 bb 98 98 e0 5f 05 d5 e9 76 3a 8a b5 87 05 09 f2 1f ba f7 8d 95 15 d9 9e da da 6c 69 2a 71 c4 e5 53 dd c6 43 cd d2 30 f4 f3 1b 27 01 b7 dd f2 81 63 c8 0a 5b b7 c2 1e 85 5c b2 9d 1b b8 ca a9 57 3d 28 90 d7 4d b9 dd 4d d7 2e c3 46 69 8a 0d b1 cc d4 46 db 89 5f 3d b4 c1 ab 9a cc 5c 77 c9 8c 81 ae 08 5f f7 e7 8c 4e 80 e2 67 2a c7 af 3b 95 84 Data Ascii: #Fwu\|"\|Uk5EUs\|hKh&&Y=8"hH/\D[smjXn.Ah^cy>@)L.JhmKnQ`h,@abS^_v:liqSC0'c[\W=(MM.FiF_=\w_Ng;
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 16 02 ff b8 34 ef 2b 28 84 f7 74 c0 b8 2f d4 7a 44 a3 4e a8 aa a7 aa 24 fe 90 b4 b5 db 5f 77 92 e9 96 02 c4 22 f8 ab 17 63 ee 74 14 10 0d a3 85 91 42 3a 51 e5 24 5f a7 5c 43 f3 c0 04 05 bd 36 cd de 0d 03 07 5e 27 62 9a 8c 8a 4d 18 37 39 49 a9 1b 14 48 52 f1 c3 71 3d 37 fa 3d 79 5c b4 fd d0 58 93 02 12 ee 9d a6 0d bc ad f8 62 f4 11 ca c8 9a 57 82 aa 94 08 99 cc 9c 85 0b b7 50 fe 42 e0 6f 0f b0 60 7a b0 07 7f 36 7e 02 91 b7 74 6a 83 7f d6 34 49 7d f5 d2 9f 7b b8 d8 ea 22 22 89 ca 47 c4 dd 1a 9c 06 f1 22 2d 9e 4f d5 af 7b 8f 34 d8 31 11 17 b7 2b 87 93 a2 45 ff 45 c2 a9 fc 3e cd 68 3d 6c c0 7f a7 38 96 e1 7e 82 b9 dc 87 1a b6 67 db 50 31 6c fd 2e a0 ac 5e 1d 83 15 31 b9 41 df f5 5d 39 3d e2 bc 41 73 ae e8 fd de f8 38 bf 2f 10 48 12 9e e2 c2 b4 e1 3a bf 39 6b Data Ascii: 4+(t/zDN$_w"ctB:Q$_\C6^'bM79IHRq=7=y\XbWPBo`z6~tj4I}{""G"-O{41+EE>h=l8~gP1l.^1A]9=As8/H:9k
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 78 4d 85 3c a3 1e ef 63 21 0b 37 f3 4b 30 30 7a 7e 48 3f a8 65 79 da 34 6f c8 de 33 3e 9d 71 e7 5d e6 a8 bc 5a c3 02 64 2f 5f 6f 88 d2 1f 67 a5 ab 08 2c ea ca 76 f4 90 12 f3 8b c5 fd 01 c3 68 1b 94 0b a6 e5 d1 ea 06 4e 97 44 c2 7f 21 93 5b 03 76 36 ef 04 ae 7c 4e 90 14 ad ad 8f 8f 10 c1 b1 e3 42 fd c3 30 9d f3 0b e2 44 bd 16 ed 36 47 36 bc f6 e1 07 d9 b3 a1 9b 46 c1 b3 a0 cd 95 fd 2b 41 02 35 a1 b8 af 36 76 ab 80 f8 29 21 f7 77 91 af 87 6a 38 8c 91 9f e3 13 80 21 9d be 49 7c a9 60 4d 43 fc e2 40 ba 3b 2b cc 33 35 83 58 7e e9 8f 30 7c 6f 78 42 92 72 fc 90 a6 dd da 29 30 67 6e a6 33 ee eb 03 b6 86 2d 6f 90 97 1f 67 d7 45 8f 47 3b ca 2e 7c 6b 92 68 99 f3 56 9f 36 49 45 d0 f2 d4 62 b3 00 16 6d af 6b ce e9 e5 cf 8d 56 c1 c5 70 0c 88 80 eb fc 8f 6d 4c 6e b4 dd Data Ascii: xM<c!7K00z~H?ey4o3>q]Zd/_og,vhND![v6\|NB0D6G6F+A56v)!wj8!I\|`MC@;+35X~0\|oxBr)0gn3-ogEG;.\|khV6IEbmkVpmLn
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 00 a2 22 a8 a5 bf 42 63 56 2b ce 13 c7 f5 5e d9 8c 89 48 94 3f fe 45 23 c8 08 34 3c fd f6 f2 45 5e 6b 32 de a7 eb 42 a9 3e f3 53 7b 5e 4a c9 e5 68 e9 ac 26 2b 69 97 7d 96 85 e0 3c aa ba 5f ad 20 7c 21 7b ef 46 6c a7 7a 94 bd f2 f7 9c c4 40 d4 3c 8f b7 d2 6b 0a cd d4 92 59 34 91 92 e2 e3 de 93 70 ce f7 d7 ba dd 75 37 30 3a 36 65 83 12 51 e5 bf a5 87 97 bf b7 31 89 3d 27 43 d1 68 5a 49 e1 e2 9d 75 d8 3b 61 04 9c 15 4a 2d 53 16 bb f9 76 f7 ac f8 4d 29 c1 0b e8 f6 55 b0 d2 d3 0e fc d2 cd 94 59 13 2a b1 f7 29 ae 90 0f 4c b1 3e 2c 3f 2b ff 65 47 0f 99 80 a1 cd 88 44 26 79 3a 0d b0 02 f1 6e 3a ba 31 30 16 df 7a a2 4d d2 c9 ee 2b 4f c8 8e ac d5 2b 8f e4 c6 d8 0d 98 97 f7 74 fc cd 24 b5 cc ac f2 4b a5 bb 58 4b 72 22 fa 79 14 7c 9a b1 65 78 6f a6 4f 15 ce 84 84 e9 Data Ascii: "BcV+^H?E#4<E^k2B>S{^Jh&+i}<_ \|!{Flz@<kY4pu70:6eQ1='ChZIu;aJ-SvM)UY*)L>,?+eGD&y:n:10zM+O+t$KXKr"y\|exoO
2024-04-24 12:32:25 UTC	16384	IN	Data Raw: 2f ff e8 05 46 0c 89 4b 6e b9 6d 86 bc 26 13 0b 33 b6 67 82 97 82 f3 95 64 10 cc a2 23 0c 0b 73 00 97 61 66 88 71 78 0c 4a 8b 66 01 7e 89 de 67 8e 72 ca ea 3c 01 fa 9e 16 b8 5b f5 a7 f6 e4 29 b5 71 a5 43 e5 40 c1 1c 04 ce 1c 39 b3 70 ca 1a 70 d5 cd c8 cb ea c2 76 5e 69 e1 7b ec 70 a7 75 8c aa 54 8e cc d9 67 59 48 69 d4 60 4d 1d 83 2e 8e 8f 17 42 70 07 6a 6d a6 e8 83 f4 d9 8b cf 3c bc bb f8 14 7a 89 6c e8 1a 94 54 e0 83 22 cd 8b 81 04 13 39 0a 87 49 76 50 d5 65 f6 fb 67 c3 90 67 76 49 8f 5b 7a 84 20 18 47 8f aa d5 f5 07 83 fe f5 78 ac f5 85 cf 88 ad 16 77 d7 25 0b b4 c2 20 b5 c6 d2 33 a6 be 80 4a 3e a6 19 f6 30 c4 63 b8 18 94 cd a7 3e df 3d db 5f eb ff 13 b3 58 a4 73 4b 37 a1 be 1a ac 68 d0 bb da 30 6b a3 64 8b c7 ad 6d 0c d8 a6 53 de 01 1d 40 1f c4 5a b3 Data Ascii: /FKnm&3gd#safqxJf~gr<[)qC@9ppv^i{puTgYHi`M.Bpjm<zlT"9IvPeggvI[z Gxw% 3J>0c>=_XsK7h0kdmS@Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49723	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:40 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:41 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f26dfbe988a7b848996c166e29cfa8a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: KrBxFbQq6KsG3bT35h_NNM3nb6ovjGjsdTtin0pnK6_AI2hgJb9Xsw== Age: 54
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:41 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49725	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:41 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:41 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 9fa56be62b1be7dd446abf03b1b07c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 7ruy5WOzZLVeh5FJmpzYqZnT2vQGdQWVdZ0YcjIEzCPMxMCGTqoMgQ== Age: 58
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:32:41 UTC	13098	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: 8b fe bf d0 b1 0e bd 0f e3 5a bd 9f 4e a4 b2 45 a0 10 57 60 43 17 3d 51 c3 74 f1 a7 a7 d5 56 67 ab c5 30 bf 20 58 bc 81 e4 66 cc ee ca b9 ff 0a e9 f6 55 68 b3 9c 54 99 51 35 2b 88 c5 ea 7f ea 63 3b 27 40 2c 1c 0b 7f b2 08 e3 e5 83 e3 41 d9 6a 13 07 e1 d6 c1 8a 08 1e fd ef 16 72 05 a4 d5 53 7a 03 e7 5a 7f 32 57 cd f7 43 01 36 6e 98 f4 4a 9a 4e d2 33 59 cb a3 81 40 9b 5e 92 72 53 ba 72 95 76 85 2c 4d fb 08 46 c8 21 e5 ac 34 7b 84 e2 09 c3 49 97 48 9a 6e 8e 28 3c f2 ee da dd 4a a5 58 82 a5 ed f5 45 ba 3f 2d d8 2a ee 57 9d 3a e0 c4 d9 0b ab 6f 98 f6 85 ab a1 59 68 24 d5 44 ba 4c 91 a0 0e 5d ac 3e 3b 22 eb a9 87 25 10 f9 ad 07 e2 d4 77 fe e2 cf 8d 9d e6 ba f4 7e 40 a1 b8 74 ac 9c 1a 6c fc d4 75 79 d9 9a b5 a0 44 1f 15 a5 50 d9 66 87 ab e8 2e 48 3c c4 9e 85 82 Data Ascii: ZNEW`C=QtVg0 XfUhTQ5+c;'@,AjrSzZ2WC6nJN3Y@^rSrv,MF!4{IHn(<JXE?-*W:oYh$DL]>;"%w~@tluyDPf.H<
2024-04-24 12:32:41 UTC	16384	IN	Data Raw: aa bd c7 48 04 0d df 0f 5d 49 97 81 ca 84 cc bd 41 6b 5f 81 fb d8 c8 38 ba b0 02 c6 40 36 cc 20 1d 48 25 87 1d c5 7e 6d 21 b1 49 16 c5 c5 5c 52 07 ef 26 5d ca 33 08 0a c1 85 5d 99 c3 b1 5c 16 f8 58 42 8d 2a ea 37 f1 70 e1 6b 95 b6 d6 e5 c3 b3 ae 28 bd ce 6a 43 b9 49 e6 af 41 7f 53 1a 22 37 29 7b 67 70 09 b0 55 a1 73 95 4a ac 0c ac 2b 36 e9 fc 71 d4 e4 63 44 d9 28 83 21 7b 71 05 20 f1 b7 67 ee 0d cf 69 d8 c4 ed bd da c0 f5 aa 0c 0b 66 eb 7c 21 2d 3f 66 3d 1d 5a ad 09 7e 7f 42 dc ae 2e 4b 94 8e 55 47 79 11 85 48 4e 81 02 94 82 42 7e 50 1c fe 07 52 18 5d 87 e5 e1 4f f8 7f 3a 96 ce f3 4e 9c f0 9c 04 7c 7b 89 80 02 b5 4c e4 f7 e3 c9 8b 44 88 7d 93 51 39 68 37 dd 1a 8a de 5d b5 33 9a fb 65 c0 cd 3d 41 a6 c5 69 e1 11 78 39 94 48 4e 82 bd 62 fd 86 ce 3b 0f bb 26 Data Ascii: H]IAk_8@6 H%~m!I\R&]3]\XB*7pk(jCIAS"7){gpUsJ+6qcD(!{q gif\|!-?f=Z~B.KUGyHNB~PR]O:N\|{LD}Q9h7]3e=Aix9HNb;&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49726	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:44 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:44 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 22970b0a8867d7ddc056c13511c8bfbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: QLMH6auDTcmgtSX2Z3E4HZMqldeUTiIjqq26zPtRItOGNKtGO-oU4A== Age: 57
2024-04-24 12:32:44 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:44 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49728	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:44 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:44 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 e6b6e5bd4ef6b9f2229ba5086dfcbb0e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ufBBRPrkBm15tTPo7pR2qEMqTmYZzsAqIz_eAeKdWzK7268ttXqUxw== Age: 61
2024-04-24 12:32:44 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:44 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:32:45 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49729	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:46 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:46 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 dea310182adc0039c16f39c12748a7f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: n92FpbALjRC-NMyHSBcPJldpRROnNpboWNXOlserUfqhc3Xg2r4zvQ== Age: 59
2024-04-24 12:32:46 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:46 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49731	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:46 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:47 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 8b7ef769fc2c91a0e16129302042a4c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: HDEqFfVDoBlAgVO2GSMw4fmjJQbCFbuudo-1PFM1wodkMqj52uI4gQ== Age: 63
2024-04-24 12:32:47 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:32:47 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49732	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:48 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:49 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 666c2260eba58c2b69ea2e6ef70667be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 7uC_fKO7jofE3HykrCaf0GSB9nkn_BO5qRlYN0TZVBZVSHuujmYpFw== Age: 62
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:49 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49734	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:49 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:49 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 22970b0a8867d7ddc056c13511c8bfbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: N-zFeoO2CmhQrLFqL42vrsGgJp6bxRU-0pI5xpw5TS3Bkn_OV8hdvg== Age: 66
2024-04-24 12:32:49 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:49 UTC	15822	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: f9 34 f9 a3 30 dc 71 6c 86 a0 cc ed 62 be 4a 51 6d fb 91 9d 2f 2c a7 b9 c0 8d 7b b2 4d b2 f1 ff 61 d1 c6 21 1f f7 81 1c bb 83 2b 9a 36 37 e9 0f e8 ff f4 15 a7 e2 46 59 c7 05 65 7d 51 5f 8f 15 3e df 74 6b 29 b8 57 74 de 90 9d 03 7e 21 1c 2a 3c 34 35 b0 63 0a dd 34 66 8a 57 4a 52 ea c9 a7 47 79 26 80 94 fb 86 1e 14 ef 72 bc 50 99 75 1a 23 21 31 b4 a2 03 7f 61 c7 f2 e4 60 7e 9e 06 86 92 8b d8 03 cf 33 a2 90 37 58 2d 3f aa dd 9b bf fe 0f 0f 44 48 77 29 4f 32 e7 66 cc e0 66 c7 ee 9e 55 30 cc e3 69 5f 7b 63 6d 28 53 1b 21 b0 05 a4 7e 1e 77 45 ba df 24 28 ed 78 69 d7 5e 22 13 53 1d 35 40 7a 20 47 86 81 ea 26 0b 4f 36 71 5b fb 1f 1f f8 7c b8 df b4 22 d9 37 4d 88 31 0a 3e 3f dd b5 53 4c 4c fb c4 1d 59 af 12 8c 0e ee 68 42 29 40 dc ad df 85 e8 99 7b 9f e6 ac 3b 92 Data Ascii: 40qlbJQm/,{Ma!+67FYe}Q_>tk)Wt~!*<45c4fWJRGy&rPu#!1a`~37X-?DHw)O2ffU0i_{cm(S!~wE$(xi^"S5@z G&O6q[\|"7M1>?SLLYhB)@{;
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: 9b 60 bc 35 c3 e8 93 11 7b 31 34 77 8a 45 0b 90 cb 36 68 bf 57 af 0a 43 f5 dc 2f 39 1a 91 61 0c 92 39 ed f5 a3 b1 4f 6e c9 d9 6f c9 3d 9b 01 cf c2 10 49 2b 9e 32 1b 7e 79 68 c1 3d de 3e 0c ae 61 a2 15 e8 64 27 6e 37 4a bd 72 e2 98 32 4d 87 3e 94 08 95 83 a9 61 34 2d 5b 14 16 18 98 e3 45 f8 68 b2 68 b1 41 21 a9 04 e8 f4 49 89 76 e7 fd e4 af ca 9c a5 81 43 77 2d 0c 59 19 b8 1d 98 66 15 19 28 1e 7f fa 26 ca 23 a9 4f da dc b7 9f 50 b0 e3 08 ff e4 c5 9b 42 7e 0e f6 df 73 d2 25 73 ec f2 76 ef 49 96 91 46 5d 91 52 a8 80 c5 08 a7 be 05 e2 61 1a 96 2c 90 df e3 bc 8c 2e 97 2d 10 07 76 59 e7 5c 4c 77 da ca af 58 03 8f 2f 21 5d ea a3 a4 4a 36 a7 53 f5 bd ea b2 16 9d 42 b2 d0 59 74 2e c0 4b 3f 53 b9 38 f4 57 4d 77 8e f9 fa 18 b2 80 a9 e6 c2 e6 de b8 a0 7c da d6 db 55 Data Ascii: `5{14wE6hWC/9a9Ono=I+2~yh=>ad'n7Jr2M>a4-[EhhA!IvCw-Yf(&#OPB~s%svIF]Ra,.-vY\LwX/!]J6SBYt.K?S8WMw\|U
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: 38 08 06 72 46 c8 27 5e 14 8a 5b 9e 09 2e b5 56 a5 a5 fc 78 97 bd 3d 9a 7f 0c 5e 1d 30 f5 5d 89 8e 97 b6 69 0e 7d e5 9e a6 c4 11 4b e4 8b 98 57 b4 c2 04 77 be 48 4b 96 f0 6e 99 95 e3 10 3d 63 1c 9b 16 62 58 90 82 fc 7f 7e 18 7d c1 16 e0 66 94 f8 2b ed 19 1f 8f 83 c1 ce 50 30 8d ac 3c 89 9e db 3e fa a6 ca f6 d2 d6 58 7c 01 b3 0c 72 02 24 e4 15 05 53 ad e9 7c 02 91 c4 04 e3 e6 e2 a3 b8 0f 99 3e 0c 42 6a 34 da 9f e5 29 5c 98 e7 6c 65 c5 8b c0 90 97 80 1d e0 0b cf 12 42 db 88 6f 90 38 e8 73 31 55 0b bd 01 e5 58 45 da 7a 46 84 e9 4a a5 17 98 ae f5 67 fb 3a 9f bd 5c b5 02 3f f1 e0 5d 29 dc 8d cc b1 f2 1a a4 42 9e 02 ac 87 4a 86 e9 f9 c4 a8 c3 6b 98 57 de d9 ec 64 cc 04 b7 e6 bb f3 7e 20 58 a8 31 65 c2 71 67 6e b0 21 a0 a6 92 fd b2 4e b2 a7 a4 09 58 1e fa 00 22 Data Ascii: 8rF'^[.Vx=^0]i}KWwHKn=cbX~}f+P0<>X\|r$S\|>Bj4)\leBo8s1UXEzFJg:\?])BJkWd~ X1eqgn!NX"
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: f7 35 39 2c 17 34 d5 cd 90 5d cc ab ac ee 7e ea 38 75 34 da c9 aa 25 79 6e 06 c7 a1 43 91 27 c9 d8 45 2a be 93 3c c7 d0 9e 10 8e 8b f6 e0 4e 72 e4 f6 0d d4 9c 8c 3d 84 0d b9 8a 65 4c 77 3b 73 b8 ac 89 7f 74 5d fb 16 eb 9f 3c 7d 86 90 81 48 1f af 36 72 7a c5 84 b1 ab 10 52 4a ca 1c 99 73 1d 26 51 03 59 98 09 a5 82 8c c4 37 23 33 e9 30 16 ee 48 f2 89 f0 fd 70 a5 88 54 3a 33 31 b3 5d 78 ce 01 d7 4a 14 61 74 26 03 ba e9 19 cf 08 b6 86 da 1f 67 cc a0 be 99 30 ed bf 10 ca 3f fb 29 ef ce ea a1 1d c5 6e 7c 25 5a f2 0f 1a db 64 ff 4b cb 01 f1 3d e9 ca 4f d9 5e ae c9 8f b4 dd a5 6d bc b1 07 5d 17 1c 81 54 5d 98 ea ff 4e 72 eb d4 e4 ea f4 8f 9a 7a 80 83 a7 8c a8 8d 38 ca 4c 1a 9a 00 9f 28 7a 0c 7d 34 7c 94 4d 34 4b 92 90 fd de e7 c0 ef 3b d8 86 1b c4 87 fd a4 ae 46 Data Ascii: 59,4]~8u4%ynC'E*<Nr=eLw;st]<}H6rzRJs&QY7#30HpT:31]xJat&g0?)n\|%ZdK=O^m]T]Nrz8L(z}4\|M4K;F
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: b2 07 76 79 15 ce 32 e7 e4 e1 80 b8 85 fc 74 ac 86 a1 5f f5 15 7a 90 42 47 72 b7 8e 9f 3b 6a 75 94 d9 1d bf a4 71 cd b5 58 22 11 29 40 fc 70 4a ff c9 08 a0 ea 47 76 2f be a5 8d bd 1d 13 c6 24 a6 7e ba fe 66 a6 b1 b2 83 72 9c 2b 16 39 54 4f 76 7a f3 b0 70 c8 f2 ff 8d 05 c0 73 3a c4 db 90 16 0c d1 59 fd e9 07 79 f2 90 2d be 21 7d 90 d3 ee 82 fb 23 97 40 70 35 b9 c4 93 61 b6 c6 57 ff dd 65 83 08 56 7b 11 22 ff d8 a1 95 6a f7 47 1a 09 f9 14 a5 79 6e fe 2b fb f1 78 cf 6c 98 d7 79 79 e8 1f e5 07 d5 48 c1 a4 89 d5 4c 6f 8b 6c a6 41 6e 15 b7 18 0a 7f 21 df 19 e2 75 ae c2 16 7e f9 d6 fb 9b e7 6f b6 c5 87 f4 53 d8 4d 81 67 d5 5d 75 fc df ac 29 8e 2a ed d1 ad 62 ac c3 72 c5 28 44 ed d4 7a eb fb f8 0b 98 48 8b bf 7b 7d f8 4b ed 71 b5 fb 9a 34 ff e9 48 83 d4 da 23 22 Data Ascii: vy2t_zBGr;juqX")@pJGv/$~fr+9TOvzps:Yy-!}#@p5aWeV{"jGyn+xlyyHLolAn!u~oSMg]u)*br(DzH{}Kq4H#"
2024-04-24 12:32:49 UTC	16384	IN	Data Raw: b1 c2 23 72 9a 5f e5 2d 70 80 94 7d 80 cb 55 9e 2c 87 b1 24 30 5b 6f 46 91 ee 70 c3 20 72 1a f0 31 f9 ab 62 59 d1 f3 0f 2f 1f c9 3c 3f c4 81 28 55 a4 34 80 3d 82 fb 8d be 05 19 87 08 c4 68 b7 bc 5a 92 c6 96 89 ff 4d 8f f1 43 87 e9 72 c3 42 9d 70 8f 28 99 f3 7a 8f 54 8a 7f 06 04 e9 84 ee db 97 d7 09 a6 8c 8f 0f e6 34 5c b7 86 00 3b c4 25 af 74 82 46 02 5f 9b d4 39 1d ba 71 fe 84 0e fa e4 07 24 0f 32 8e 5f 4b 13 34 ed 9d 9c cf fb 73 8d f3 81 8b 68 fa cc 6a 86 c1 0a 35 1a aa 78 f5 40 cb 82 75 84 35 13 15 6b 86 ca dc 17 d9 dc 16 d8 0e ff a3 fa c7 05 8a 05 05 81 81 9e 1b b4 ee ac a5 6a f9 fe c8 68 94 7a c8 55 25 8f 06 4f 33 05 51 f2 3a 38 72 3f 6d a9 b9 d2 35 6d 38 ef 0b a9 8f 5a 5f a1 c8 3d 4a 4b a8 ce 49 45 bc c3 e5 2e 38 fb 55 48 aa 42 a8 f9 e9 ac 29 0d fd Data Ascii: #r_-p}U,$0[oFp r1bY/<?(U4=hZMCrBp(zT4\;%tF_9q$2_K4shj5x@u5kjhzU%O3Q:8r?m5m8Z_=JKIE.8UHB)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49735	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:51 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:51 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d10240e7319a7132a723389f68b24380.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: zzs9423kuJAKLRvvmbnP6xn_sHu99i3vpgK_DuNbT3Gx8196la71Jw== Age: 64
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:51 UTC	12398	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=
2024-04-24 12:32:51 UTC	340	IN	Data Raw: b3 36 da d4 7e af 3d b3 cc 25 17 18 56 c0 e6 0e c8 9b ff bb a3 9e 5d 60 18 9c 66 f5 96 6f 41 22 36 63 d3 be 72 fa 55 ed a9 fd 53 f8 5c e8 3b c8 ac 69 65 28 dc f1 7b a5 91 40 80 d2 64 4e dd 1b 13 57 ad fa da ec 30 89 56 07 b9 60 ce d8 a2 74 95 55 75 aa 26 c6 d7 5f 43 37 72 d9 fe 16 89 9e 8e df 06 ea bd 2c f6 fb 6f aa 55 77 6a a5 92 41 fd 9a bf 12 fc b9 3c 2f 91 e5 c9 60 dd b6 0b 29 e1 76 52 28 3c 47 38 38 50 37 7c 45 f1 36 95 19 79 51 09 41 d0 08 4d a3 c1 52 38 d4 33 18 24 58 ca bb 54 95 04 0e 7c 83 74 ff e2 53 fd 06 31 57 77 03 a8 48 a9 8c a8 72 f8 f4 33 6a 2b 8c 7f bd ca de 29 2c 90 0d d9 75 63 69 6d d4 b7 fd f6 79 be c6 03 a0 fc de 6a 77 61 c2 f4 c7 56 79 62 e8 d6 36 a2 10 ed e5 f1 01 1e ba bc 44 8d cf eb 49 e4 11 91 f5 37 7b b0 06 3b eb 1d 32 d5 fb 60 Data Ascii: 6~=%V]`foA"6crUS\;ie({@dNW0V`tUu&_C7r,oUwjA</`)vR(<G88P7\|E6yQAMR83$XT\|tS1WwHr3j+),ucimyjwaVyb6DI7{;2`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49736	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:51 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:51 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 029709435e1da82d2fcf38cfaa581f38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 5WHig24nDGaThlZdZtLQ5wyVqzJ44UlSQX_QwzeLv3v7Olr_hzmiQg== Age: 68
2024-04-24 12:32:51 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:32:51 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49738	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:52 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:52 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 22970b0a8867d7ddc056c13511c8bfbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: Gbe14uCi3h75nbyfKh89CN8NnTFhMeiSSuUP7ZhTR0c-NbPntcTS4A== Age: 65
2024-04-24 12:32:52 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:52 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49740	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:52 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:52 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 3c0c0202765b2b7b973e2ad3371dd028.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: E_HWWQRpweyJJUSiQwmnDHYUAxo332q273ui_ExksKUUhMCSVebrmQ== Age: 69
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:32:53 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49741	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:54 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:54 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 1c5a7e2dbc29e2ce87f40dbbc168a96c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: WQVsvy6PrEnRcJN3krBSSzICWBlO07kSY89kuV23kEpVO3yQZcTzBw== Age: 67
2024-04-24 12:32:54 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:54 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49742	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:54 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:54 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: XW2MLQhcXkl9XR7pXfQuxwB5rG3yP446TyWeKZbahMCibAMBCylW4g== Age: 71
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:32:54 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49744	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:55 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:56 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 80d98973224a18eb4f01e04477b53316.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ghyAxq1-KEmfvN9Jy_9owImvUO4bopDi5ba4F-OVbM7g2OZH28bXhw== Age: 68
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:56 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49745	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:55 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:56 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6be51685f3d6c8586915cd0d829c6d14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: vBnX18hZCae2e2R0NRB0qDI5vHNy3TsXQWe_qA_nEz-jYVAFPbC9Dg== Age: 73
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:32:56 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49747	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:57 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:57 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 4d2lqN25NW2Uti0RSeMV5-PQcSZC2_LcGOCAKERn8sTdNUEDqmsPHg== Age: 70
2024-04-24 12:32:57 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:57 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49749	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:57 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:57 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 8e2ab8d4ebdf363d2c4ab61a7cc5bc34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 7RI6Uu8FFRcdNnyUjl-LutDkyxI6OyttYDFyGm6poJpDg6rYGRkgYw== Age: 74
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:32:57 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:32:58 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:32:58 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:32:58 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:32:58 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49750	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:58 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:59 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 9c75a2f695ad1c7a78bd2b623f5a2762.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: HU2b7J31SEurI-m5Io0RNL5IbVBf7rIAEq81IuwUzE5ak6Nb9ElBHg== Age: 72
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:32:59 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49752	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:32:58 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:32:59 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 3c0c0202765b2b7b973e2ad3371dd028.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: bz8f8lLp0cX0X0m6vO0Hwxf5oXKJpqE-UAUMFb99EZj-XOpcCYEHWw== Age: 76
2024-04-24 12:32:59 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:32:59 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49753	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:00 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:00 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f17e2ae5998b0b8b03850e97d88e04a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: KvNyFojo4RQNhQEu7VG32VKQ8Xicdp-9nLLyU3st1Z3rS8xdIHhNfA== Age: 73
2024-04-24 12:33:00 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:00 UTC	12398	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=
2024-04-24 12:33:00 UTC	340	IN	Data Raw: b3 36 da d4 7e af 3d b3 cc 25 17 18 56 c0 e6 0e c8 9b ff bb a3 9e 5d 60 18 9c 66 f5 96 6f 41 22 36 63 d3 be 72 fa 55 ed a9 fd 53 f8 5c e8 3b c8 ac 69 65 28 dc f1 7b a5 91 40 80 d2 64 4e dd 1b 13 57 ad fa da ec 30 89 56 07 b9 60 ce d8 a2 74 95 55 75 aa 26 c6 d7 5f 43 37 72 d9 fe 16 89 9e 8e df 06 ea bd 2c f6 fb 6f aa 55 77 6a a5 92 41 fd 9a bf 12 fc b9 3c 2f 91 e5 c9 60 dd b6 0b 29 e1 76 52 28 3c 47 38 38 50 37 7c 45 f1 36 95 19 79 51 09 41 d0 08 4d a3 c1 52 38 d4 33 18 24 58 ca bb 54 95 04 0e 7c 83 74 ff e2 53 fd 06 31 57 77 03 a8 48 a9 8c a8 72 f8 f4 33 6a 2b 8c 7f bd ca de 29 2c 90 0d d9 75 63 69 6d d4 b7 fd f6 79 be c6 03 a0 fc de 6a 77 61 c2 f4 c7 56 79 62 e8 d6 36 a2 10 ed e5 f1 01 1e ba bc 44 8d cf eb 49 e4 11 91 f5 37 7b b0 06 3b eb 1d 32 d5 fb 60 Data Ascii: 6~=%V]`foA"6crUS\;ie({@dNW0V`tUu&_C7r,oUwjA</`)vR(<G88P7\|E6yQAMR83$XT\|tS1WwHr3j+),ucimyjwaVyb6DI7{;2`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49754	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:00 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:00 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: dLTmrJO1b7u1_KpmQCrZs_LQzcn1lKetjvN4zCIbuh7JOPIwJm-hfg== Age: 77
2024-04-24 12:33:00 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:00 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:00 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:01 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49756	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:01 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:02 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 e6b6e5bd4ef6b9f2229ba5086dfcbb0e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: n2q-0S_Tnl1Kklr0Usvhq6XFbg-dqs4lBozaO3DNwau_2iKJk1P4vg== Age: 75
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:02 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49757	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:02 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:02 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 d753bdff57c5dcd160113c97de38707a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: oKrhhJHYNa7j3winB8HKj7M3Gbm1FLBAJZrRwZD-5kHGYONbpl0gcA== Age: 79
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:02 UTC	13776	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: c6 57 d2 5f d7 d7 0b bb ac ef eb 2b d3 2e 0c 9e 0f de f2 55 c7 3b ee 05 66 b6 80 8b 91 92 9b b1 78 0f c2 c3 5c 02 2d 1b 6e 43 9b d4 e8 a0 1e 4f 9c 24 0b b8 dd 0d 25 ec 37 a2 4d 37 7e f2 32 ea 89 f4 86 ac 6a c0 18 8f fe 4a b5 d3 e4 b4 13 6c 62 6a 71 0d 4d 06 ec cb bd 43 eb de d3 8d d8 e0 ad 85 bb 23 6d d3 51 7a a7 b8 5b 72 d9 5d d1 fe 66 e1 f9 7b 11 ff 0e 02 7e 6b ac 91 90 0e e9 2a e2 d5 b7 21 a5 b0 ed ba b8 e1 0c 31 29 f5 d4 79 30 63 64 f9 3b a7 43 09 b7 5e 9a 82 cd f2 ab c1 66 bf 86 64 08 b1 6d 2a ce ae 4b 93 d0 68 2a 79 f4 7e 84 b6 aa b8 d7 ba 76 6e d1 4c 41 77 ac d8 a5 f0 5a 2a 58 7a a2 b9 45 3e 05 86 3c c1 ce c8 4f b9 8f 50 3e 84 52 e7 fa ed 70 aa 13 91 2f bd 45 5d 58 ff 4c ee 91 6c d1 55 70 a6 1c 33 f1 da 22 49 84 9a 48 ae 30 33 45 71 0d 01 1a cd 6e Data Ascii: W_+.U;fx\-nCO$%7M7~2jJlbjqMC#mQz[r]f{~k!1)y0cd;C^fdmKhy~vnLAwZXzE><OP>Rp/E]XLlUp3"IH03Eqn
2024-04-24 12:33:02 UTC	16384	IN	Data Raw: 05 b9 46 84 4f 76 66 a7 8f 1e 7b 1d a5 83 66 39 8e 10 2a 8a a6 b3 af 35 4e 28 27 88 ba fc d8 4d 0f 15 75 e8 9f a8 a3 cd 44 d5 40 c6 45 4a 95 f7 ae 1b 38 b5 3e 2e 5b 9a 27 93 74 e5 9c 20 ff 4d c2 8c 9f 98 15 cf 11 b6 ff 42 38 d4 e3 8f b6 9c 11 c6 28 3d 0d df 5d 83 17 f9 5b b4 da 4e eb f1 4f d5 5c 97 fe fc c0 39 6f 72 3a ed 20 18 87 85 62 2e 78 58 be 53 62 08 6e 5c 19 c7 ba 8b be f8 55 dd e7 be e7 ca 66 dc 32 2b 09 50 d2 a1 26 41 5c 8d 2b 48 b8 a4 2b 50 80 98 8c eb 96 ca f2 c6 c6 b7 8d a4 ca 79 d3 01 6e cb 83 0b 81 dd 63 be ab b2 89 c2 46 75 ae 64 d3 60 02 90 2f c7 35 85 e6 18 88 d7 42 b7 4f e1 93 3e 66 8a 1e 42 89 97 1d 92 fc 09 3c 8d a1 37 28 bc 99 b8 bb 38 be fa 3d c8 6c 06 26 01 75 87 c8 9e bb b3 3f 4a 4b c3 37 18 8a 48 43 1b b7 32 05 c0 09 9e 2f 54 75 Data Ascii: FOvf{f9*5N('MuD@EJ8>.['t MB8(=][NO\9or: b.xXSbn\Uf2+P&A\+H+PyncFud`/5BO>fB<7(8=l&u?JK7HC2/Tu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49759	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:03 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:03 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 22970b0a8867d7ddc056c13511c8bfbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: wYFsxKabW8d4-Mk4tiv3cPNAOAw5BxrAj4wDGH3_7hm5diixPHgYsA== Age: 76
2024-04-24 12:33:03 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:03 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49761	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:03 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:03 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 dea310182adc0039c16f39c12748a7f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: Yj6GtZepng3AedRtH3jREZ91kJ0sdIG1u0QIGZu6jZuMpavz_2EbLg== Age: 80
2024-04-24 12:33:03 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:04 UTC	13232	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: fb 08 46 c8 21 e5 ac 34 7b 84 e2 09 c3 49 97 48 9a 6e 8e 28 3c f2 ee da dd 4a a5 58 82 a5 ed f5 45 ba 3f 2d d8 2a ee 57 9d 3a e0 c4 d9 0b ab 6f 98 f6 85 ab a1 59 68 24 d5 44 ba 4c 91 a0 0e 5d ac 3e 3b 22 eb a9 87 25 10 f9 ad 07 e2 d4 77 fe e2 cf 8d 9d e6 ba f4 7e 40 a1 b8 74 ac 9c 1a 6c fc d4 75 79 d9 9a b5 a0 44 1f 15 a5 50 d9 66 87 ab e8 2e 48 3c c4 9e 85 82 59 ab 1a 3d 63 e3 36 76 55 dd 81 5b 67 31 6e d8 6c 7a dd ba 7a fb ae bd 44 e7 49 89 db b0 57 f9 05 a9 71 00 d5 6b e5 12 33 14 36 49 30 04 47 2e 9f fa fa 4f 5d 13 14 d4 22 fd 94 e5 2f 79 cd c3 a0 db eb 82 d0 17 6d 06 f9 36 86 e2 00 17 cd 65 7d 8b e1 b5 01 d5 48 44 4e 4e 66 8a 53 72 4d 5b cf f7 27 e8 45 6f 53 62 40 0e 13 d4 72 d8 a2 59 2f 47 32 f5 ba 80 e3 c5 3f 5b b5 45 fb da 2f c1 49 9f 8c bf 3c dc Data Ascii: F!4{IHn(<JXE?-*W:oYh$DL]>;"%w~@tluyDPf.H<Y=c6vU[g1nlzzDIWqk36I0G.O]"/ym6e}HDNNfSrM['EoSb@rY/G2?[E/I<
2024-04-24 12:33:04 UTC	16384	IN	Data Raw: 69 d8 c4 ed bd da c0 f5 aa 0c 0b 66 eb 7c 21 2d 3f 66 3d 1d 5a ad 09 7e 7f 42 dc ae 2e 4b 94 8e 55 47 79 11 85 48 4e 81 02 94 82 42 7e 50 1c fe 07 52 18 5d 87 e5 e1 4f f8 7f 3a 96 ce f3 4e 9c f0 9c 04 7c 7b 89 80 02 b5 4c e4 f7 e3 c9 8b 44 88 7d 93 51 39 68 37 dd 1a 8a de 5d b5 33 9a fb 65 c0 cd 3d 41 a6 c5 69 e1 11 78 39 94 48 4e 82 bd 62 fd 86 ce 3b 0f bb 26 d0 c4 2f ff 11 59 c4 9c ea 0e ec 48 a5 6c 3c c8 ad c0 37 7f 21 ae fd 25 4e f1 a6 65 d9 7e 1c ac dc e5 87 96 b3 f1 10 88 11 1c 62 9a b9 dc e3 2d ab 01 b7 fb 4d ec ad 3f 80 00 80 b9 79 b7 b7 12 50 50 fb 82 f4 df c3 b8 20 74 2f df b5 9b 9f 18 ab ee 26 c7 f5 8d dd f5 a8 d9 f1 9b 3b 6c d2 56 40 76 08 4e ac 03 dc 2d e2 6c e4 95 cb c0 04 fe 02 69 3a 6d 6f 8b 6f 0f 8f 37 0d 60 03 0e 49 74 75 0a ae 93 ff c2 Data Ascii: if\|!-?f=Z~B.KUGyHNB~PR]O:N\|{LD}Q9h7]3e=Aix9HNb;&/YHl<7!%Ne~b-M?yPP t/&;lV@vN-li:moo7`Itu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49762	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:05 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:05 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 9c75a2f695ad1c7a78bd2b623f5a2762.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: cWyweUcpQrlpi_3bFp6RWxAZSY6p2QZHEBYfDeuLlFD6U75lxbPoeg== Age: 78
2024-04-24 12:33:05 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:05 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49764	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:05 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:05 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 d10240e7319a7132a723389f68b24380.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: nHogWrK0vkdIEiO30JySyXDlFhtTEa16AUdUqRlxfYs2twOUJUcXUw== Age: 82
2024-04-24 12:33:05 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:05 UTC	11836	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 47 7a 14 9b 29 67 04 b9 70 d0 40 79 6c 64 f7 73 04 90 8e 81 cc 63 b5 27 c3 10 c4 26 88 1f e8 57 aa 92 c3 95 8d da 59 e4 fb 4d 2c 3a 41 83 08 d9 ae 74 d2 7c d4 d1 95 64 86 c1 69 e4 76 c3 31 9b 22 9e 4a fe f3 7f 29 78 d7 a5 17 f6 e0 26 d9 48 a4 d8 62 e2 38 07 85 41 44 02 15 3c f5 41 c1 1b 09 b6 e6 fd e1 1f d6 08 0b 66 13 ad e4 21 35 a3 3f 90 f0 3e f0 01 6e 9f 8b 48 99 ec 2a 5f 3e 0c 67 df 1f 2d f4 9b ba dd 7f ef 01 c8 d5 29 b6 f8 52 8f 68 31 e5 81 4e 92 eb 8c 3d f0 c1 9b ed 1c 61 9a 34 06 dc 5a 35 64 00 d8 9b 19 74 f3 9a 95 19 3b c9 4e f6 4f c1 49 48 9b 7f c7 69 7e 47 93 0e eb 41 0a 34 f8 25 dd 83 cf b5 ee 83 59 85 5e 4e aa 05 67 f8 bb a3 38 b9 48 d9 be 4b 28 c5 f2 d5 c9 55 ff 87 87 8e e1 0e fa e6 b5 93 ba b8 62 fc fb f3 a9 ec 72 92 50 20 ec 47 1b 4a c9 67 Data Ascii: Gz)gp@yldsc'&WYM,:At\|div1"J)x&Hb8AD<Af!5?>nH*_>g-)Rh1N=a4Z5dt;NOIHi~GA4%Y^Ng8HK(UbrP GJg
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: cc 7c 88 c1 97 71 bd 27 2e bb ae 62 e2 b7 dd c5 b4 81 24 77 c0 32 47 5d 8d 0a bd 53 13 ce 1c 16 68 59 c0 25 87 16 74 40 43 20 7e c3 d1 58 fa ca 6c 1c 8e ee 32 08 ed bd 89 bf 5e 44 14 66 4f 26 47 50 79 83 c4 c3 f3 f6 96 c9 ec 29 84 91 43 35 4c df 0c 1f 81 e7 c4 80 c2 a3 71 7e e6 55 bb 9e ab 10 8c dd 68 72 d4 30 79 74 ae 6d 7e 80 3c c3 79 cb 72 e2 55 28 9b 62 62 6a e8 d5 c8 c1 3d 2b f0 0e ac 85 34 5a 47 fd 8b 58 f6 18 b9 ff 68 11 38 a2 0f 6d c7 46 1f 11 4a 05 cb ed 11 6c 1f 7c 65 42 a6 64 e4 ad 84 64 9f 8a 4c af 7b 9f b4 b1 38 56 71 a9 9d cb 9e fc 08 9e b9 88 de e6 b0 69 cd 26 e5 a4 2c 62 f5 6c f0 f1 1e de 9a c7 06 43 23 e9 bd e2 a2 90 d5 16 a9 b8 9b e8 8f 55 98 3b 43 b2 91 5f 13 bc 5f 3c 32 aa 9c e9 20 b3 79 e2 72 c4 a3 4b 16 6f f4 50 a1 aa 49 3e b7 94 f6 Data Ascii: \|q'.b$w2G]ShY%t@C ~Xl2^DfO&GPy)C5Lq~Uhr0ytm~<yrU(bbj=+4ZGXh8mFJl\|eBddL{8Vqi&,blC#U;C__<2 yrKoPI>
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 3a 7c 68 8a 90 2f 14 20 60 4e 2f 0e 2c 80 f7 11 f2 5c 4d fd 86 38 7f 69 a3 92 b5 f3 33 24 01 11 e9 f3 8c 10 1e 03 e0 a3 69 0b 1c e6 95 55 41 88 67 ac 20 3a a2 46 48 71 b3 a7 e2 9a ee bd 02 78 c5 fb b8 c2 40 61 c0 ae 46 d3 bb 8e 0b 74 a3 38 40 1f 39 ed 09 17 37 20 05 f6 4c 06 17 18 10 e3 45 6c 11 8c db 8f ba 9c 92 10 1d e8 6f 0c 3c 7d 0f ba 4d 31 51 46 4e 22 1e 4d 49 6c c8 ef 34 78 a8 82 c5 29 4a b6 b1 64 3c a5 96 0e 66 06 61 66 19 a0 43 0f b2 1d 57 a5 fe c1 83 10 9d 25 d3 41 c8 ec 2c fa b3 26 a3 99 f6 ab bf 1f ed 8f d3 30 7f 55 dd 45 9b db 7b 5a 99 67 de 03 a5 10 42 9e 0b 6d 39 bc f2 87 00 4f 5e bb b5 d7 8e c3 ae 17 ca 3f 89 1c 3d 2a 2b c0 3a c5 6d d4 64 3d cb f7 2b 66 83 d0 92 9d 32 d9 2f 29 62 4e a3 6b 9b bc 9d df 2c 4c 4f e8 ef 31 d9 54 0b cc 50 65 0c Data Ascii: :\|h/ `N/,\M8i3$iUAg :FHqx@aFt8@97 LElo<}M1QFN"MIl4x)Jd<fafCW%A,&0UE{ZgBm9O^?=*+:md=+f2/)bNk,LO1TPe
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 7f c1 ea 02 ca 3c 1a d8 d8 74 f3 a5 6b 7f 1a 37 46 b9 1f cd cf d0 9b 7f 88 86 cc f3 c6 c4 ef 0b 0a a4 c3 fc 92 48 a0 03 df 08 b0 06 5a 7a 4c 4e e5 f8 e3 4e 3e 96 cb 22 b3 56 56 5b 40 b9 c6 58 2f f6 51 83 df 2e 81 f7 3c 65 48 ff 33 0c 43 cc fa 08 46 6d 0c fc d6 2c 0b 9c 85 a3 06 a6 09 7e 9a e8 8e 5c da 80 df 21 53 9d e4 75 c2 d6 94 74 26 fa 7b a7 3b 9f d1 cd 67 31 8d 39 f2 a5 71 04 44 ac ef 4c a4 38 af b1 64 c5 c7 17 11 34 a9 f4 98 44 cc 01 50 e8 8d 71 65 3d 93 dd 1c ca 63 12 80 50 c7 bc e5 ce c5 8d e7 5f d6 26 f5 52 8e 11 23 97 3c 97 9f 2b 4c 6b 88 59 a9 a9 80 95 2d b1 8d e4 63 a1 da 50 fc 95 5a fd 24 90 fe 01 ba d0 7c 0a 12 20 be 1a 0e a1 5d 42 4e 67 08 97 d4 7e f0 44 27 34 1f 34 8f 8d 2b cd ac 88 50 2b 5a 93 90 78 74 9b aa cb ec 28 21 6a 02 ad e0 20 b5 Data Ascii: <tk7FHZzLNN>"VV[@X/Q.<eH3CFm,~\!Sut&{;g19qDL8d4DPqe=cP_&R#<+LkY-cPZ$\| ]BNg~D'44+P+Zxt(!j
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 88 2f 64 54 14 7f da cd 9f 19 0c cc 44 70 84 92 5f 2e f5 1c 93 bc 5f d8 0f e0 02 eb a0 d9 34 8a c6 e1 99 e6 06 52 53 2e c3 66 ab 6d f5 8a 80 9a d5 03 0a 7a 2f b9 46 48 4a fe 18 00 d3 a1 c2 d8 12 fa e6 a7 ea 45 a8 37 ec ef 50 05 20 3d 50 f2 a8 3d 09 c4 ef 8e d7 c2 87 6f 03 69 6a 0d da 95 f6 59 4e 86 0f db de 07 e3 5a 42 03 3c cb 7f a5 58 05 3c 47 89 d0 98 89 73 c4 0f 7b f5 6a b0 e6 67 58 51 3e 19 e0 e5 f9 cf 4f 19 41 c7 e1 db 24 82 e5 11 97 39 76 45 4d 1f 0b 95 01 58 ca e2 d0 ab a4 55 39 e6 b3 5d 3e f0 4a fe 7f 10 45 2c c3 20 d4 0d 06 29 a2 f6 b2 2b bd b5 89 fa 99 8c c1 0c d3 a4 d0 59 c7 a2 34 ab 6e 71 dc 90 80 c7 2b bf 6e 9f 61 bb 99 be 13 13 5b 06 6c 47 9b c0 a0 89 ef f6 39 4c 83 bb c7 b9 32 16 85 40 19 d0 ee 99 24 98 c6 14 53 c3 fb da e6 a5 8d aa d9 d4 Data Ascii: /dTDp_._4RS.fmz/FHJE7P =P=oijYNZB<X<Gs{jgXQ>OA$9vEMXU9]>JE, )+Y4nq+na[lG9L2@$S
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 91 b9 34 c5 7e 25 2e 11 08 4d b5 0f 06 87 10 d6 b2 3e dc a3 d5 d4 1d 87 8e 9d d5 e1 17 e4 e7 07 67 30 92 21 33 53 c7 41 3d 5c 7d b4 35 4b da 5d a1 c1 bd 63 08 d1 dc 74 e4 13 1f cc 1e b7 b2 27 29 eb a5 10 4b 71 b9 b1 8f 89 d5 85 08 e6 57 de bb 11 6b 52 e3 da 9d b6 1c c0 8f 66 f6 9a 12 e7 0a c0 d2 b6 19 90 d0 31 ae 94 59 d2 72 ac 2e ad 1f 5c 47 9e bd 3b bb 85 2e 57 62 61 a3 ca db 3b 01 17 fc 49 ea 05 18 90 45 92 78 a7 83 b7 35 71 b8 02 23 31 74 61 c4 53 7d bf c4 c9 f7 21 9f 9f 2c 9c 85 60 45 96 50 18 b7 5c e0 b8 a2 e7 e1 94 65 9f 03 54 ee 28 d6 c8 ae c5 b5 9b 0a 19 19 40 68 00 88 8e 07 83 66 08 e9 0f 94 fd 3f d7 d4 1d 14 bc e6 48 76 cf 6a 26 ae be 96 9c 8a b5 61 9e 19 e1 c2 3a f5 84 db fc 2e 3e 59 53 58 85 91 9a 30 3b 07 1a 1e e1 07 6d a4 75 21 10 f4 49 66 Data Ascii: 4~%.M>g0!3SA=\}5K]ct')KqWkRf1Yr.\G;.Wba;IEx5q#1taS}!,`EP\eT(@hf?Hvj&a:.>YSX0;mu!If
2024-04-24 12:33:05 UTC	16384	IN	Data Raw: 27 0f 09 49 3d 61 b6 f0 59 ce 08 b0 5d 60 17 7f 66 98 95 cb 57 eb 41 57 06 27 eb 92 c3 b5 42 af 0c 6f f4 62 7b 72 64 0f 22 91 6f 32 45 37 2e 9b f8 6c d0 e4 31 84 e0 77 e3 4a d1 51 91 6f d2 d4 ce 65 03 94 a4 58 ac c9 8f 03 d5 6b 52 ce 8a a0 20 81 98 e4 91 89 df 19 50 49 dd c7 c9 f0 07 42 27 05 07 e4 aa 04 84 c1 5c 04 2a ac 76 99 a5 5c 17 8f 54 6a d3 e9 20 0b 76 f8 3e 7a 80 69 b0 db a4 87 97 04 3d f8 01 e2 45 55 27 43 6f d5 8c bf 78 95 b8 d5 35 cf 03 ad e5 19 35 65 b9 3e 24 94 b6 2b 66 70 cb 68 43 22 0d 60 51 11 9e fa ce 0f 28 d2 c6 0a f1 00 65 9e 8e bd 30 e7 be 71 54 0c 9f df bc 8f 22 a3 00 24 a2 72 e9 ce eb a2 3a c9 ee 4b 24 67 8b bb 52 87 66 dd e8 05 0b 68 22 6d 2a e2 10 72 cc af 64 63 6c fc dd 66 7c c4 e1 19 71 1e 01 fa 65 ed 62 0b ba 28 b1 75 a6 21 0e Data Ascii: 'I=aY]`fWAW'Bob{rd"o2E7.l1wJQoeXkR PIB'\v\Tj v>zi=EU'Cox55e>$+fphC"`Q(e0qT"$r:K$gRfh"mrdclf\|qeb(u!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49765	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:06 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:07 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 9c75a2f695ad1c7a78bd2b623f5a2762.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 8XXBprpk7VOKmg0zmndnqr6RNdzAkNziKZa-Y5Wt3I8Hq0MdMNAphA== Age: 79
2024-04-24 12:33:07 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:07 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49767	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:06 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:07 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 1c5a7e2dbc29e2ce87f40dbbc168a96c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: NTB1PcP6b35BOdqs4ZwzYI1LMclIOk9gpspsqkbSWPKVFz0L_HsUrw== Age: 84
2024-04-24 12:33:07 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:07 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49768	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:08 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:08 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 2d00df3f936d7626d50853ebd0e73b30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ijFYLWAmFWDZG-oY-90UqFJweWBQw1J-Vv96ZZ1IiM32tfOOXAVL6g== Age: 81
2024-04-24 12:33:08 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:08 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49770	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:08 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:08 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 666c2260eba58c2b69ea2e6ef70667be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: CMkCMFJDuz9X62EnGeIk9FC9lIfP5SZMEV0N02ylds7_sI-5acjWSQ== Age: 85
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:08 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:09 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:09 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:33:09 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49771	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:09 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:10 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: FaA356wLwfEgaiHKAGy5tfF8jjfwPbdCgzU0ilLIFICDFbjXUDGbkg== Age: 83
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:10 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49773	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:09 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:10 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 7c0e64bd446b0a1023d64b949a17451a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: iQuoOpETs9k1llcAPOhbNZWxnDSgE7metPMcQY3ww2civYJ2YYBTFA== Age: 87
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:10 UTC	14808	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:10 UTC	544	IN	Data Raw: f5 3e 47 00 19 25 28 7f a4 d5 7e ee b0 7c 5e 8c 31 cc 73 99 eb b6 e9 c6 14 37 41 5b b3 d2 f5 cf 36 dc 31 8f b5 bb 88 7b 71 b7 12 ec 2c 7f cc 61 f8 dd bd a0 16 90 fd c8 35 63 91 12 30 90 59 74 b7 30 2c a8 9a 70 41 e1 bd b1 28 f3 d5 17 e8 2b 14 66 3f 51 ab ff 71 7a e6 17 9a 54 52 de 82 33 f1 3d 0d f4 f8 6b f2 a8 3e fa c6 96 0e 59 4a f4 da 70 f2 7a 36 3b c7 23 f3 d3 ca 86 63 6c 0a 6a 6e 33 e9 8c 56 9c 3d bf 86 83 35 08 d5 6d 48 d8 11 43 51 2c ef 78 3e e9 4e c7 30 43 aa 7f 7b 75 a7 32 cc c8 f7 ae 9b ac 53 8b 93 37 16 54 d9 46 ad 0c 1e 6d 00 f6 b1 d2 38 42 c2 11 ad 63 2b 30 cc f7 98 a0 66 ab eb d5 f4 74 e4 81 df 9a 6e 25 3d 17 9e c5 d4 27 c9 84 6d 70 4e 9b d6 95 09 22 b7 72 7b d4 dd 9d d2 a4 57 7a 19 7f 02 85 31 de 3c ac b2 0d d0 65 4f 99 3f d7 93 dd 61 08 8f Data Ascii: >G%(~\|^1s7A[61{q,a5c0Yt0,pA(+f?QqzTR3=k>YJpz6;#cljn3V=5mHCQ,x>N0C{u2S7TFm8Bc+0ftn%='mpN"r{Wz1<eO?a
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: f9 34 f9 a3 30 dc 71 6c 86 a0 cc ed 62 be 4a 51 6d fb 91 9d 2f 2c a7 b9 c0 8d 7b b2 4d b2 f1 ff 61 d1 c6 21 1f f7 81 1c bb 83 2b 9a 36 37 e9 0f e8 ff f4 15 a7 e2 46 59 c7 05 65 7d 51 5f 8f 15 3e df 74 6b 29 b8 57 74 de 90 9d 03 7e 21 1c 2a 3c 34 35 b0 63 0a dd 34 66 8a 57 4a 52 ea c9 a7 47 79 26 80 94 fb 86 1e 14 ef 72 bc 50 99 75 1a 23 21 31 b4 a2 03 7f 61 c7 f2 e4 60 7e 9e 06 86 92 8b d8 03 cf 33 a2 90 37 58 2d 3f aa dd 9b bf fe 0f 0f 44 48 77 29 4f 32 e7 66 cc e0 66 c7 ee 9e 55 30 cc e3 69 5f 7b 63 6d 28 53 1b 21 b0 05 a4 7e 1e 77 45 ba df 24 28 ed 78 69 d7 5e 22 13 53 1d 35 40 7a 20 47 86 81 ea 26 0b 4f 36 71 5b fb 1f 1f f8 7c b8 df b4 22 d9 37 4d 88 31 0a 3e 3f dd b5 53 4c 4c fb c4 1d 59 af 12 8c 0e ee 68 42 29 40 dc ad df 85 e8 99 7b 9f e6 ac 3b 92 Data Ascii: 40qlbJQm/,{Ma!+67FYe}Q_>tk)Wt~!*<45c4fWJRGy&rPu#!1a`~37X-?DHw)O2ffU0i_{cm(S!~wE$(xi^"S5@z G&O6q[\|"7M1>?SLLYhB)@{;
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: 9b 60 bc 35 c3 e8 93 11 7b 31 34 77 8a 45 0b 90 cb 36 68 bf 57 af 0a 43 f5 dc 2f 39 1a 91 61 0c 92 39 ed f5 a3 b1 4f 6e c9 d9 6f c9 3d 9b 01 cf c2 10 49 2b 9e 32 1b 7e 79 68 c1 3d de 3e 0c ae 61 a2 15 e8 64 27 6e 37 4a bd 72 e2 98 32 4d 87 3e 94 08 95 83 a9 61 34 2d 5b 14 16 18 98 e3 45 f8 68 b2 68 b1 41 21 a9 04 e8 f4 49 89 76 e7 fd e4 af ca 9c a5 81 43 77 2d 0c 59 19 b8 1d 98 66 15 19 28 1e 7f fa 26 ca 23 a9 4f da dc b7 9f 50 b0 e3 08 ff e4 c5 9b 42 7e 0e f6 df 73 d2 25 73 ec f2 76 ef 49 96 91 46 5d 91 52 a8 80 c5 08 a7 be 05 e2 61 1a 96 2c 90 df e3 bc 8c 2e 97 2d 10 07 76 59 e7 5c 4c 77 da ca af 58 03 8f 2f 21 5d ea a3 a4 4a 36 a7 53 f5 bd ea b2 16 9d 42 b2 d0 59 74 2e c0 4b 3f 53 b9 38 f4 57 4d 77 8e f9 fa 18 b2 80 a9 e6 c2 e6 de b8 a0 7c da d6 db 55 Data Ascii: `5{14wE6hWC/9a9Ono=I+2~yh=>ad'n7Jr2M>a4-[EhhA!IvCw-Yf(&#OPB~s%svIF]Ra,.-vY\LwX/!]J6SBYt.K?S8WMw\|U
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: 38 08 06 72 46 c8 27 5e 14 8a 5b 9e 09 2e b5 56 a5 a5 fc 78 97 bd 3d 9a 7f 0c 5e 1d 30 f5 5d 89 8e 97 b6 69 0e 7d e5 9e a6 c4 11 4b e4 8b 98 57 b4 c2 04 77 be 48 4b 96 f0 6e 99 95 e3 10 3d 63 1c 9b 16 62 58 90 82 fc 7f 7e 18 7d c1 16 e0 66 94 f8 2b ed 19 1f 8f 83 c1 ce 50 30 8d ac 3c 89 9e db 3e fa a6 ca f6 d2 d6 58 7c 01 b3 0c 72 02 24 e4 15 05 53 ad e9 7c 02 91 c4 04 e3 e6 e2 a3 b8 0f 99 3e 0c 42 6a 34 da 9f e5 29 5c 98 e7 6c 65 c5 8b c0 90 97 80 1d e0 0b cf 12 42 db 88 6f 90 38 e8 73 31 55 0b bd 01 e5 58 45 da 7a 46 84 e9 4a a5 17 98 ae f5 67 fb 3a 9f bd 5c b5 02 3f f1 e0 5d 29 dc 8d cc b1 f2 1a a4 42 9e 02 ac 87 4a 86 e9 f9 c4 a8 c3 6b 98 57 de d9 ec 64 cc 04 b7 e6 bb f3 7e 20 58 a8 31 65 c2 71 67 6e b0 21 a0 a6 92 fd b2 4e b2 a7 a4 09 58 1e fa 00 22 Data Ascii: 8rF'^[.Vx=^0]i}KWwHKn=cbX~}f+P0<>X\|r$S\|>Bj4)\leBo8s1UXEzFJg:\?])BJkWd~ X1eqgn!NX"
2024-04-24 12:33:10 UTC	14808	IN	Data Raw: f7 35 39 2c 17 34 d5 cd 90 5d cc ab ac ee 7e ea 38 75 34 da c9 aa 25 79 6e 06 c7 a1 43 91 27 c9 d8 45 2a be 93 3c c7 d0 9e 10 8e 8b f6 e0 4e 72 e4 f6 0d d4 9c 8c 3d 84 0d b9 8a 65 4c 77 3b 73 b8 ac 89 7f 74 5d fb 16 eb 9f 3c 7d 86 90 81 48 1f af 36 72 7a c5 84 b1 ab 10 52 4a ca 1c 99 73 1d 26 51 03 59 98 09 a5 82 8c c4 37 23 33 e9 30 16 ee 48 f2 89 f0 fd 70 a5 88 54 3a 33 31 b3 5d 78 ce 01 d7 4a 14 61 74 26 03 ba e9 19 cf 08 b6 86 da 1f 67 cc a0 be 99 30 ed bf 10 ca 3f fb 29 ef ce ea a1 1d c5 6e 7c 25 5a f2 0f 1a db 64 ff 4b cb 01 f1 3d e9 ca 4f d9 5e ae c9 8f b4 dd a5 6d bc b1 07 5d 17 1c 81 54 5d 98 ea ff 4e 72 eb d4 e4 ea f4 8f 9a 7a 80 83 a7 8c a8 8d 38 ca 4c 1a 9a 00 9f 28 7a 0c 7d 34 7c 94 4d 34 4b 92 90 fd de e7 c0 ef 3b d8 86 1b c4 87 fd a4 ae 46 Data Ascii: 59,4]~8u4%ynC'E*<Nr=eLw;st]<}H6rzRJs&QY7#30HpT:31]xJat&g0?)n\|%ZdK=O^m]T]Nrz8L(z}4\|M4K;F
2024-04-24 12:33:10 UTC	16384	IN	Data Raw: c6 57 d2 5f d7 d7 0b bb ac ef eb 2b d3 2e 0c 9e 0f de f2 55 c7 3b ee 05 66 b6 80 8b 91 92 9b b1 78 0f c2 c3 5c 02 2d 1b 6e 43 9b d4 e8 a0 1e 4f 9c 24 0b b8 dd 0d 25 ec 37 a2 4d 37 7e f2 32 ea 89 f4 86 ac 6a c0 18 8f fe 4a b5 d3 e4 b4 13 6c 62 6a 71 0d 4d 06 ec cb bd 43 eb de d3 8d d8 e0 ad 85 bb 23 6d d3 51 7a a7 b8 5b 72 d9 5d d1 fe 66 e1 f9 7b 11 ff 0e 02 7e 6b ac 91 90 0e e9 2a e2 d5 b7 21 a5 b0 ed ba b8 e1 0c 31 29 f5 d4 79 30 63 64 f9 3b a7 43 09 b7 5e 9a 82 cd f2 ab c1 66 bf 86 64 08 b1 6d 2a ce ae 4b 93 d0 68 2a 79 f4 7e 84 b6 aa b8 d7 ba 76 6e d1 4c 41 77 ac d8 a5 f0 5a 2a 58 7a a2 b9 45 3e 05 86 3c c1 ce c8 4f b9 8f 50 3e 84 52 e7 fa ed 70 aa 13 91 2f bd 45 5d 58 ff 4c ee 91 6c d1 55 70 a6 1c 33 f1 da 22 49 84 9a 48 ae 30 33 45 71 0d 01 1a cd 6e Data Ascii: W_+.U;fx\-nCO$%7M7~2jJlbjqMC#mQz[r]f{~k!1)y0cd;C^fdmKhy~vnLAwZXzE><OP>Rp/E]XLlUp3"IH03Eqn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49774	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:11 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:11 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: R1Z2LxIr6Ar7EvEcMDtynEgZpxhpJVQAwBqK2C5mIgEC32w42UA8BQ== Age: 84
2024-04-24 12:33:11 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:11 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49776	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:11 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:11 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 3c0c0202765b2b7b973e2ad3371dd028.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: V7x6FRc6BJoGo3YvJLaayBNxBrVI0kbBTrIMyXz-jghmF3W6xNGo4w== Age: 88
2024-04-24 12:33:11 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:11 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:11 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:11 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:12 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49777	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:12 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:13 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 40e91b31dd840e2e02680165e2c720fa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ZCymWe3qyS0RXbQZx1N01KAJMV8SsYZVKEt26U4lcE_k-os-v_tpFg== Age: 86
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:13 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49779	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:13 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:13 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 1c5a7e2dbc29e2ce87f40dbbc168a96c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ZWyv9Lk9dj9OaHxsvNMqu7UUKwQOopbR2GZdnyqC-qYFULZ5B8tSCg== Age: 90
2024-04-24 12:33:13 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:13 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49780	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:14 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:14 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f03e10929a5a49b0e892d7ac0a147ac8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ebQDuPmHZYr2wqJs0Aq9Qt5_gXQzf1LnYfHke4CiSgBFJ2DzNM3TUw== Age: 87
2024-04-24 12:33:14 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:14 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49782	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:14 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:14 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 567a2d2f8a3ac0cb43e8d4a0bb1bd63c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: fM3WiKN9FLV-G4hqZSOWMVMHfzyACumM_ghlvIx-vX7Q20mwf-ksPA== Age: 91
2024-04-24 12:33:14 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:14 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:15 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49783	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:16 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:16 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 89fb248da6d030379dec9569a47a0c92.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 7p6uZUE4reznctkdojUaVIUZ37YCGGyhJ4ElcGVXUuJVErQcmJilHA== Age: 89
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:16 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49784	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:16 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:16 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 81c9c18fb33769240d77079676b28890.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: lnJ76EZbalbZRPgC_Y75JCXjJ2h_GfyGEWGuqbaUnWY0I101qBUR4Q== Age: 93
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:33:16 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49786	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:17 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:17 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d753bdff57c5dcd160113c97de38707a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 7K0phqoFqygKdcbpCTNhsieROq0ooceZ5CJhG5WszzSoVKk6zoRFkQ== Age: 90
2024-04-24 12:33:17 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:17 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49787	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:17 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:18 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 a4840d65c9b0feceec7a77f10199d82a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: UKSedD8o1rAT2SiqtSeT1chsQheoid-qId2j58gDqYnMOeUfl32aCQ== Age: 94
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:18 UTC	14808	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: f5 3e 47 00 19 25 28 7f a4 d5 7e ee b0 7c 5e 8c 31 cc 73 99 eb b6 e9 c6 14 37 41 5b b3 d2 f5 cf 36 dc 31 8f b5 bb 88 7b 71 b7 12 ec 2c 7f cc 61 f8 dd bd a0 16 90 fd c8 35 63 91 12 30 90 59 74 b7 30 2c a8 9a 70 41 e1 bd b1 28 f3 d5 17 e8 2b 14 66 3f 51 ab ff 71 7a e6 17 9a 54 52 de 82 33 f1 3d 0d f4 f8 6b f2 a8 3e fa c6 96 0e 59 4a f4 da 70 f2 7a 36 3b c7 23 f3 d3 ca 86 63 6c 0a 6a 6e 33 e9 8c 56 9c 3d bf 86 83 35 08 d5 6d 48 d8 11 43 51 2c ef 78 3e e9 4e c7 30 43 aa 7f 7b 75 a7 32 cc c8 f7 ae 9b ac 53 8b 93 37 16 54 d9 46 ad 0c 1e 6d 00 f6 b1 d2 38 42 c2 11 ad 63 2b 30 cc f7 98 a0 66 ab eb d5 f4 74 e4 81 df 9a 6e 25 3d 17 9e c5 d4 27 c9 84 6d 70 4e 9b d6 95 09 22 b7 72 7b d4 dd 9d d2 a4 57 7a 19 7f 02 85 31 de 3c ac b2 0d d0 65 4f 99 3f d7 93 dd 61 08 8f Data Ascii: >G%(~\|^1s7A[61{q,a5c0Yt0,pA(+f?QqzTR3=k>YJpz6;#cljn3V=5mHCQ,x>N0C{u2S7TFm8Bc+0ftn%='mpN"r{Wz1<eO?a
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 23 06 be 46 77 13 75 06 f7 7c 22 1b e5 e7 99 04 7c e6 e4 ef 80 09 08 f2 55 10 a8 83 6b 35 0b 45 55 83 ef 73 7c 68 92 4b 9f be 94 cd fa 00 f1 68 26 26 eb 59 3d bb e2 38 22 94 68 48 11 2f d6 b6 5c 44 eb 5b c9 73 13 6d 6a ba 58 07 f3 6e ef 07 2e 41 dd aa 91 13 a1 68 b6 89 f1 c2 5e 63 79 90 3e 0d 1a ca 40 b9 29 4c ed ed f9 9d 2e 4a 02 ab 68 c3 6d 4b 10 ec 08 ce 6e fc 51 60 68 04 2c ca be 40 61 b0 81 62 fa 11 f8 db 53 5e 0d c8 bb 98 98 e0 5f 05 d5 e9 76 3a 8a b5 87 05 09 f2 1f ba f7 8d 95 15 d9 9e da da 6c 69 2a 71 c4 e5 53 dd c6 43 cd d2 30 f4 f3 1b 27 01 b7 dd f2 81 63 c8 0a 5b b7 c2 1e 85 5c b2 9d 1b b8 ca a9 57 3d 28 90 d7 4d b9 dd 4d d7 2e c3 46 69 8a 0d b1 cc d4 46 db 89 5f 3d b4 c1 ab 9a cc 5c 77 c9 8c 81 ae 08 5f f7 e7 8c 4e 80 e2 67 2a c7 af 3b 95 84 Data Ascii: #Fwu\|"\|Uk5EUs\|hKh&&Y=8"hH/\D[smjXn.Ah^cy>@)L.JhmKnQ`h,@abS^_v:liqSC0'c[\W=(MM.FiF_=\w_Ng;
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 16 02 ff b8 34 ef 2b 28 84 f7 74 c0 b8 2f d4 7a 44 a3 4e a8 aa a7 aa 24 fe 90 b4 b5 db 5f 77 92 e9 96 02 c4 22 f8 ab 17 63 ee 74 14 10 0d a3 85 91 42 3a 51 e5 24 5f a7 5c 43 f3 c0 04 05 bd 36 cd de 0d 03 07 5e 27 62 9a 8c 8a 4d 18 37 39 49 a9 1b 14 48 52 f1 c3 71 3d 37 fa 3d 79 5c b4 fd d0 58 93 02 12 ee 9d a6 0d bc ad f8 62 f4 11 ca c8 9a 57 82 aa 94 08 99 cc 9c 85 0b b7 50 fe 42 e0 6f 0f b0 60 7a b0 07 7f 36 7e 02 91 b7 74 6a 83 7f d6 34 49 7d f5 d2 9f 7b b8 d8 ea 22 22 89 ca 47 c4 dd 1a 9c 06 f1 22 2d 9e 4f d5 af 7b 8f 34 d8 31 11 17 b7 2b 87 93 a2 45 ff 45 c2 a9 fc 3e cd 68 3d 6c c0 7f a7 38 96 e1 7e 82 b9 dc 87 1a b6 67 db 50 31 6c fd 2e a0 ac 5e 1d 83 15 31 b9 41 df f5 5d 39 3d e2 bc 41 73 ae e8 fd de f8 38 bf 2f 10 48 12 9e e2 c2 b4 e1 3a bf 39 6b Data Ascii: 4+(t/zDN$_w"ctB:Q$_\C6^'bM79IHRq=7=y\XbWPBo`z6~tj4I}{""G"-O{41+EE>h=l8~gP1l.^1A]9=As8/H:9k
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 78 4d 85 3c a3 1e ef 63 21 0b 37 f3 4b 30 30 7a 7e 48 3f a8 65 79 da 34 6f c8 de 33 3e 9d 71 e7 5d e6 a8 bc 5a c3 02 64 2f 5f 6f 88 d2 1f 67 a5 ab 08 2c ea ca 76 f4 90 12 f3 8b c5 fd 01 c3 68 1b 94 0b a6 e5 d1 ea 06 4e 97 44 c2 7f 21 93 5b 03 76 36 ef 04 ae 7c 4e 90 14 ad ad 8f 8f 10 c1 b1 e3 42 fd c3 30 9d f3 0b e2 44 bd 16 ed 36 47 36 bc f6 e1 07 d9 b3 a1 9b 46 c1 b3 a0 cd 95 fd 2b 41 02 35 a1 b8 af 36 76 ab 80 f8 29 21 f7 77 91 af 87 6a 38 8c 91 9f e3 13 80 21 9d be 49 7c a9 60 4d 43 fc e2 40 ba 3b 2b cc 33 35 83 58 7e e9 8f 30 7c 6f 78 42 92 72 fc 90 a6 dd da 29 30 67 6e a6 33 ee eb 03 b6 86 2d 6f 90 97 1f 67 d7 45 8f 47 3b ca 2e 7c 6b 92 68 99 f3 56 9f 36 49 45 d0 f2 d4 62 b3 00 16 6d af 6b ce e9 e5 cf 8d 56 c1 c5 70 0c 88 80 eb fc 8f 6d 4c 6e b4 dd Data Ascii: xM<c!7K00z~H?ey4o3>q]Zd/_og,vhND![v6\|NB0D6G6F+A56v)!wj8!I\|`MC@;+35X~0\|oxBr)0gn3-ogEG;.\|khV6IEbmkVpmLn
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 00 a2 22 a8 a5 bf 42 63 56 2b ce 13 c7 f5 5e d9 8c 89 48 94 3f fe 45 23 c8 08 34 3c fd f6 f2 45 5e 6b 32 de a7 eb 42 a9 3e f3 53 7b 5e 4a c9 e5 68 e9 ac 26 2b 69 97 7d 96 85 e0 3c aa ba 5f ad 20 7c 21 7b ef 46 6c a7 7a 94 bd f2 f7 9c c4 40 d4 3c 8f b7 d2 6b 0a cd d4 92 59 34 91 92 e2 e3 de 93 70 ce f7 d7 ba dd 75 37 30 3a 36 65 83 12 51 e5 bf a5 87 97 bf b7 31 89 3d 27 43 d1 68 5a 49 e1 e2 9d 75 d8 3b 61 04 9c 15 4a 2d 53 16 bb f9 76 f7 ac f8 4d 29 c1 0b e8 f6 55 b0 d2 d3 0e fc d2 cd 94 59 13 2a b1 f7 29 ae 90 0f 4c b1 3e 2c 3f 2b ff 65 47 0f 99 80 a1 cd 88 44 26 79 3a 0d b0 02 f1 6e 3a ba 31 30 16 df 7a a2 4d d2 c9 ee 2b 4f c8 8e ac d5 2b 8f e4 c6 d8 0d 98 97 f7 74 fc cd 24 b5 cc ac f2 4b a5 bb 58 4b 72 22 fa 79 14 7c 9a b1 65 78 6f a6 4f 15 ce 84 84 e9 Data Ascii: "BcV+^H?E#4<E^k2B>S{^Jh&+i}<_ \|!{Flz@<kY4pu70:6eQ1='ChZIu;aJ-SvM)UY*)L>,?+eGD&y:n:10zM+O+t$KXKr"y\|exoO
2024-04-24 12:33:18 UTC	16384	IN	Data Raw: 2f ff e8 05 46 0c 89 4b 6e b9 6d 86 bc 26 13 0b 33 b6 67 82 97 82 f3 95 64 10 cc a2 23 0c 0b 73 00 97 61 66 88 71 78 0c 4a 8b 66 01 7e 89 de 67 8e 72 ca ea 3c 01 fa 9e 16 b8 5b f5 a7 f6 e4 29 b5 71 a5 43 e5 40 c1 1c 04 ce 1c 39 b3 70 ca 1a 70 d5 cd c8 cb ea c2 76 5e 69 e1 7b ec 70 a7 75 8c aa 54 8e cc d9 67 59 48 69 d4 60 4d 1d 83 2e 8e 8f 17 42 70 07 6a 6d a6 e8 83 f4 d9 8b cf 3c bc bb f8 14 7a 89 6c e8 1a 94 54 e0 83 22 cd 8b 81 04 13 39 0a 87 49 76 50 d5 65 f6 fb 67 c3 90 67 76 49 8f 5b 7a 84 20 18 47 8f aa d5 f5 07 83 fe f5 78 ac f5 85 cf 88 ad 16 77 d7 25 0b b4 c2 20 b5 c6 d2 33 a6 be 80 4a 3e a6 19 f6 30 c4 63 b8 18 94 cd a7 3e df 3d db 5f eb ff 13 b3 58 a4 73 4b 37 a1 be 1a ac 68 d0 bb da 30 6b a3 64 8b c7 ad 6d 0c d8 a6 53 de 01 1d 40 1f c4 5a b3 Data Ascii: /FKnm&3gd#safqxJf~gr<[)qC@9ppv^i{puTgYHi`M.Bpjm<zlT"9IvPeggvI[z Gxw% 3J>0c>=_XsK7h0kdmS@Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49789	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:19 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:19 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 8b7ef769fc2c91a0e16129302042a4c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ZYLs14gM8OwP7RL3yAEWEK1r9dPAGo6B4fh0IgEFV5JI8M2rD9mj5Q== Age: 92
2024-04-24 12:33:19 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:19 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49790	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:19 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:19 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 250c0cb00d06687b06322aeb6c0379f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: XGKwKCNlsXnHKKd6wOLzQwujfk_VRCOeNsDKOKej8mfnk4bvX6TbJQ== Age: 96
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:19 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:33:20 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49792	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:20 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:21 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 8e2ab8d4ebdf363d2c4ab61a7cc5bc34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: X-Wj36pzd91zgvJPz2755KIrg25ucEqBsl1-8A7O9LtZYqr3JBBOXw== Age: 94
2024-04-24 12:33:21 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:21 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49793	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:20 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:21 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: X2U8-w3xxlQkJbm2PACAsJ_w16a2SZRxhLgzkbcj729971DCrV5a3A== Age: 98
2024-04-24 12:33:21 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 27 Data Ascii: )1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_'
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 6b Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(k
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 cb Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*11
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 63 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]c
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 5e Data Ascii: 4u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km^
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb 8f Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 dd Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:21 UTC	16384	IN	Data Raw: f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 b4 Data Ascii: $ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49795	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:22 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:22 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f03e10929a5a49b0e892d7ac0a147ac8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: EzxcwLcItjGcfFG_zKKTZLJmOrrk3954HT-KONa5Y_g6ZsEAACjDDg== Age: 95
2024-04-24 12:33:22 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:22 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49797	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:22 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:22 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 80d98973224a18eb4f01e04477b53316.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 3ojlkYhZQQaqK66bfuPldrtm63RaUeEJ5ucjRDbrynjNC57vjIP2dQ== Age: 99
2024-04-24 12:33:22 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:22 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:22 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:22 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:22 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:23 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:23 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:23 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:23 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:33:23 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49798	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:23 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:24 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: yMrDU1RNpVx8vvCh11i-tLhF-eBxZ3LxHyIWPBakt_R2GCmwSvP9PA== Age: 97
2024-04-24 12:33:24 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:24 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49800	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:23 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:24 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 7c0e64bd446b0a1023d64b949a17451a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: fDikETH3U9qnw4G47nfCdSivxZpbkKusGblT7AC-KGfS1HtAKNTDmw== Age: 101
2024-04-24 12:33:24 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:24 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49801	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:25 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:25 UTC	469	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f03e10929a5a49b0e892d7ac0a147ac8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: cUmCz_ohMoZ_QPXhtonjkG_n6hEYp_cM0YtOchMkfRnndQ6sRoY-xw== Age: 98
2024-04-24 12:33:25 UTC	15915	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:25 UTC	13207	IN	Data Raw: 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff d5 Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49803	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:25 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:25 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: gixZWmnaFeYAUaLOR9-coq9MCQylD5Ej-nupR34WHNXYgcadabbhdA== Age: 102
2024-04-24 12:33:25 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:25 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:26 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49804	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:27 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:27 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 250c0cb00d06687b06322aeb6c0379f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: qd8iHYXcTjj0NB68ThANJ7nPmRbqc-HUZyVG5LHfx5fdq7xI5zGWYg== Age: 100
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:27 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49806	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:27 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:27 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 80d98973224a18eb4f01e04477b53316.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: uk579xLsvykX9R_I_Zx4ecBzhwoJFqX2o0lnmn9O8eI-4vV2tTN2Nw== Age: 104
2024-04-24 12:33:27 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:27 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49807	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:28 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:28 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 9fa56be62b1be7dd446abf03b1b07c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: vTbiiuUmzxqYKpnfwOAneiDUv1wp8UOvxkDByL7vVJhfvdYF-vfijg== Age: 101
2024-04-24 12:33:28 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:28 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49808	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:28 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:29 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 029709435e1da82d2fcf38cfaa581f38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: MeReG_A-iX4EciedYBPSS_yC4fVMeQmtiKHX0wqKSu5P8D8w4Nao_A== Age: 105
2024-04-24 12:33:29 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:29 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49810	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:30 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:30 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 3c0c0202765b2b7b973e2ad3371dd028.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: BSL-hwqG-w4EaF7ZFh32W9MbrxNFfLIG1FE8VJxEVLMXzZ1RCBga5g== Age: 103
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:30 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49812	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:30 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:30 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 f03e10929a5a49b0e892d7ac0a147ac8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: tM1bUqeF87AU7p4Y4AyDbW-eUpr2YcIQqF6Oa0s6JNC6uZQgyG2hRQ== Age: 107
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: f7 21 b0 55 34 ad 85 36 a9 88 81 ce 07 37 a3 5b 31 c4 ec 72 9a b7 d3 5e b0 16 93 f2 a9 e6 63 b2 f5 97 cb 00 2e 0e 0b 23 f3 f1 8f 09 cf 48 0e 10 c4 b9 f4 1e 65 37 7f 8a 1c 32 36 77 83 ae 61 6c 3a b8 7d d2 32 7f 20 bb a5 66 20 0e 48 f1 28 02 3a 5b 1d 7b 97 e5 1d 65 e7 d8 fc 32 20 ad 3d a9 83 e8 d9 c9 15 68 18 ee a9 3d 52 ee 8b c2 b9 c9 76 c0 05 b4 97 03 85 f0 3c 55 e8 6e d4 8a 8a c7 c1 9e 5a d6 03 32 eb ba a2 05 48 ac b9 dc 12 b6 35 db a6 9b b8 1b e6 83 76 60 fd 70 5a 2a d9 80 f0 46 0a 01 ce 01 a6 2e d7 e5 1e fc af a4 df 7a bc 3d 50 1b 1a 67 0d 62 8b f9 98 24 db 8b 3e 19 4d 7f b1 ad 2c d2 0c 14 9e 5f 09 13 43 bb 7b 16 23 5c a2 82 dd b9 5c d6 0c 3f d5 98 96 e5 ef 0a d2 e7 43 ae 29 61 ac 2a 50 9b 80 9a 7f e5 59 df e2 88 1d c3 01 2a e2 6d 85 de 02 c2 6d fb 34 Data Ascii: !U467[1r^c.#He726wal:}2 f H(:[{e2 =h=Rv<UnZ2H5v`pZF.z=Pgb$>M,_C{#\\?C)aPY*mm4
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 23 c3 c0 97 da a8 36 77 13 ae e4 f3 6b 21 a6 72 36 10 4c dc 0b ad 9d d2 03 52 c4 fe c0 fe c9 ee 45 ba 85 54 0d 34 c2 28 1e 13 45 00 61 c0 e2 c5 40 bb ad fc fd 87 77 9f d1 d1 5f f7 5b 97 05 6a 5c 58 10 75 76 f4 d2 17 fb ef a0 b0 a5 07 df 8c e3 44 de 11 c7 59 8d 86 fb 60 1c fc c2 62 3d af 61 fc 01 53 79 f8 4c fb c4 ac 5c d2 6a 0c c7 4e e2 e9 c9 1a 21 cd 45 3a 0e 3b 43 93 8a d6 4d f3 a0 aa f2 67 67 3b 29 11 a4 be ab 8b 5f 19 74 ac fb 16 a0 f3 af b6 6d 5f c8 a0 73 a0 e5 70 91 ed f4 0c c7 9f 86 24 03 20 e2 26 83 a2 28 1d ba c2 b9 eb c5 f8 38 61 76 f4 2f 95 9a 1d 8f 2e f0 b7 40 69 71 a0 0d 07 36 46 17 d1 7e 85 df fc e8 f9 3a 58 cc 9a 9d 81 f5 49 46 32 68 04 99 22 2a b8 4d 1d c3 11 20 13 39 2d e8 79 e2 0f c8 01 02 ed 21 5c d4 ce 6b 5b a7 25 54 a9 a5 67 9d 4c 28 Data Ascii: #6wk!r6LRET4(Ea@w_[j\XuvDY`b=aSyL\jN!E:;CMgg;)_tm_sp$ &(8av/.@iq6F~:XIF2h"*M 9-y!\k[%TgL(
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 1e 42 89 29 59 40 08 3a 37 e9 e3 26 4d 8c 7e ec 83 29 15 5b 34 82 34 72 72 ac 82 d0 33 fd 21 ff 24 ef 43 9e 00 13 97 a7 9a ee 1c 04 d9 1c b4 86 d9 71 b2 79 3a 7c fd bc 1f 15 69 6a 28 c2 72 db b6 a6 ff e0 01 c8 8f f9 b8 42 84 65 0b 6b f9 08 94 7a 9d b6 83 6d aa 66 a2 81 52 ab d9 49 20 6c 79 59 e8 61 e6 6b 37 eb 87 7a a8 4a a3 da ba 10 43 4f 63 f1 fc 32 e6 e1 af a1 ca 57 55 a5 4d 3f 5b aa 22 a4 df 45 f7 e5 52 23 e5 dd 23 38 98 d1 d5 a3 f6 b7 4f 8f 00 0f 9a 66 73 32 5c 2d 4a 54 5e ed ff 60 00 2a d4 65 12 1b ba 7e 52 b0 be 9e bb 08 fe 6d 8f 12 23 bc 90 4c f7 cb 72 bb 27 29 0e e9 24 69 8f 5e 30 a3 4a 76 ff 83 2b c8 41 f2 9c b4 1c 9f 52 f7 7c 33 81 d4 76 7e 35 1b 47 4b d9 14 d1 13 46 e0 02 7a cd 93 3d 1c 34 aa 9c 1a 02 32 42 fc a9 22 26 ec d5 6c ac 45 bf 9d 98 Data Ascii: B)Y@:7&M~)[44rr3!$Cqy:\|ij(rBekzmfRI lyYak7zJCOc2WUM?["ER##8Ofs2\-JT^`*e~Rm#Lr')$i^0Jv+AR\|3v~5GKFz=42B"&lE
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 82 69 02 35 c9 5f 3f b1 d2 53 df fe 97 66 c8 92 1e 42 b0 e4 a8 0f 6e 32 b3 9f d0 0d 23 8f a2 66 4f e6 27 69 da cc ce 6f 9a 71 6b 10 9b d7 7f b6 db 6d fd f5 c2 a1 b1 30 0a 4d 0f ca 4c b3 eb 83 43 8a e2 1d 41 18 67 d5 8b 9e 40 4a 2b 42 a0 98 c4 ae c4 c2 25 8b fa 8a 44 b1 01 c3 fe 99 76 d5 b5 89 a8 d6 83 e3 92 4f e6 f8 5a 4f 8b b2 1a 86 58 47 df 21 06 fe 14 58 da 1c ec 76 88 8f ba 1d 64 83 fe f8 3d ed 6c 82 bf 7d 4c 59 fa c8 81 90 54 39 1b 05 1d 66 a4 ca 27 74 f9 fc 58 5e f9 30 2d e8 9e 2a 28 cc ad c3 29 17 8e 3b f6 ec 64 1e 6d de bb d5 c2 d7 13 75 a3 55 94 51 0f cf bd 63 8c a8 5d 5b 6b 26 6d f6 3e 1e 14 67 b1 b4 46 62 63 1b 79 d6 d8 dc f6 30 95 ac 84 4a eb 34 2a b1 10 48 28 44 fa e7 97 20 aa 00 b9 5d b4 31 b7 d0 f7 8e bf 48 cc 85 0d 2e 4e 1b 37 de c3 8d 18 Data Ascii: i5_?SfBn2#fO'ioqkm0MLCAg@J+B%DvOZOXG!Xvd=l}LYT9f'tX^0-();dmuUQc][k&m>gFbcy0J4H(D ]1H.N7
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 11 38 fd 09 09 9d 80 e2 65 92 c3 48 5f 2e d7 66 2a 80 b7 14 2b 52 be e3 de b7 ff e8 a8 9a e4 52 33 e2 2d 31 9d e1 c2 ce 1e 7e 17 22 62 fb 18 81 ca 2e f4 11 57 4c 42 4a 5f 72 c8 02 b9 21 1d 73 a7 bf 13 73 90 d6 6b 2b 9a 13 6f 32 c7 c2 00 91 91 67 e2 6b d2 95 c0 83 43 90 15 16 57 5b 38 3b c5 ac 8f c6 8a c8 1a 20 74 57 9e da e7 47 fc 69 24 43 18 d2 a4 b2 81 d6 51 92 7d 93 d7 f4 d4 d8 36 27 c7 4e 0a ee 6e 06 9b 02 87 d2 1e 7b 22 f8 da 24 f4 e7 6a e6 6a 34 a7 a1 1f 9f 54 a9 6d 82 bc 77 58 64 a5 29 ac 16 47 15 ed 68 ba a3 c2 44 6d e9 ec 30 98 b4 c9 46 11 26 34 3e 7e 86 1b f7 01 a8 e6 1b ca 44 7b 04 88 ba 2f eb 6e ae c6 4e 48 99 8c 20 14 17 24 99 eb bf 94 3e 2a 00 e9 ce 47 0f 49 2b d7 91 8c 3f 2a b9 2c 9f 1c 9a 87 b4 a3 37 31 31 0d d3 3c 0e e9 51 1f 00 fd 7f b2 Data Ascii: 8eH_.f+RR3-1~"b.WLBJ_r!ssk+o2gkCW[8; tWGi$CQ}6'Nn{"$jj4TmwXd)GhDm0F&4>~D{/nNH $>GI+?*,711<Q
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: ce 9f 46 39 a7 cd d7 cf 19 18 8a f3 dc b3 42 14 f6 10 fc 2e c8 0f 49 e2 17 3c 2e bb 5f fa 35 81 35 1c 85 71 2b e6 36 17 f6 35 bb 62 55 d9 28 b4 56 63 19 a4 00 47 0e 39 97 22 51 13 38 f3 06 27 6f 07 43 a4 d9 db f1 e7 3e 18 e0 b9 04 36 c7 58 77 fa a4 66 29 6c 0e 9c c8 09 45 fb e2 41 4a 61 08 fe 0d 98 bf 92 c9 16 99 58 9d 05 85 7e 9f 37 fc 67 50 c9 b3 c8 bd b3 32 e8 e4 0e d2 25 58 d2 c7 4c 63 a5 4d 16 8f 74 c0 6a 41 1f f9 d4 2a ed 8f 16 ff bd 74 31 86 44 1c d0 e0 e5 2b 09 c8 c6 fe 9a 69 10 21 5b d3 4e 88 d0 f9 23 09 d9 9b 74 5b 75 5e 45 ed f8 15 6f 6b b8 99 fd 25 e7 ff 6e 44 0d 00 9d 5a 5f a4 2e 44 9a b4 6b a7 91 09 92 f7 c0 b4 e2 bf 29 91 9c db 1f 93 9a 88 78 31 06 25 20 d5 72 da f5 b3 2b f5 fb da 9f ce 11 e1 2c cd 95 d8 3e 35 d4 f4 d6 3e 12 4c 86 b5 53 21 Data Ascii: F9B.I<._55q+65bU(VcG9"Q8'oC>6Xwf)lEAJaX~7gP2%XLcMtjA*t1D+i![N#t[u^Eok%nDZ_.Dk)x1% r+,>5>LS!
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: da fa 2b 51 a2 4e bb 0e 15 ca 68 02 52 fa 5d 33 69 1f 88 a1 0e cd c9 95 5e 0e 29 d2 63 54 73 76 8e a8 22 e0 6c af 8b 85 02 3e 10 83 89 41 42 5b b4 d7 de b8 d4 33 3f 42 f7 9e 9d bd e5 b0 1e 31 1e db 01 36 1c a5 07 e4 62 f6 05 bb 44 c5 3f 40 01 07 72 be 42 1d 8f 84 14 f0 00 57 f5 92 30 0a 81 71 59 8e 65 2f 96 2d 6a b0 db 73 62 d2 45 ad 81 9f c0 7c 56 76 de 04 e5 df d4 e6 dc 58 c9 57 2d 4f 77 01 4d 05 8a f7 93 fb 99 2a b5 bd 0d f3 60 ca 47 b4 76 54 3b 3e 70 f9 42 c2 56 6c 4e c4 c6 b0 8f bb 28 61 d6 73 b8 aa 26 f6 de 29 ed 89 8f a6 17 66 75 03 49 f4 d5 d9 65 70 07 94 82 dd c7 58 ef 10 57 7b 67 ae 0c 67 91 ed ef a3 69 b5 59 0f 61 40 85 c8 5a 7b d7 26 22 16 81 34 b9 e9 8b c6 b2 e6 05 93 9e 77 f0 eb 58 5f 12 ab 50 34 bb 93 75 ee fa 07 61 e3 a6 b4 40 ff 3d 67 e9 Data Ascii: +QNhR]3i^)cTsv"l>AB[3?B16bD?@rBW0qYe/-jsbE\|VvXW-OwM*`GvT;>pBVlN(as&)fuIepXW{ggiYa@Z{&"4wX_P4ua@=g
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 0f 1d 6f 8a e6 1f 9c ed 01 5b 76 72 46 23 00 74 78 e5 bc fa d9 4a aa 6c 17 a9 d9 4e 77 33 83 46 c3 b1 73 ca af c7 7f bc d6 2c 38 ab f0 89 93 65 17 41 0b 9a a6 d6 5f 56 ca 26 cf a1 7f 3a 78 a6 88 7a 46 69 13 5c f5 53 3f 6e e5 e6 da 19 49 71 20 18 c7 07 2b 58 97 ff db a3 5c ba 91 fc 6c e3 74 a2 84 e2 03 7a 86 a3 8b 47 8d 4c a5 c6 88 f3 75 32 b7 a2 58 54 5b 6b 84 75 c8 6a 93 bc c5 7c 28 47 96 e0 94 55 13 9a c2 99 a1 3a 16 ff a1 b2 1b 82 5e 82 da a1 43 a7 c1 d5 67 a5 9b c0 4f be 5d 40 ff 1e bb a9 2d 36 a5 ea 31 3d 35 e5 fb 38 06 dd 68 09 44 2d e6 ab f5 af f8 48 66 f0 d9 8d 29 97 3d e1 73 b7 53 5f 65 27 c0 45 4a 91 46 60 76 a0 5a 7d 50 ca e4 02 b1 cb a3 b8 d4 8d f5 46 e3 66 dd ea 4b db 71 5b a9 91 89 ae 2d c3 a2 d8 99 75 74 5e 00 4a 2d e9 d8 df 0e 19 3e a9 50 Data Ascii: o[vrF#txJlNw3Fs,8eA_V&:xzFi\S?nIq +X\ltzGLu2XT[kuj\|(GU:^CgO]@-61=58hD-Hf)=sS_e'EJF`vZ}PFfKq[-ut^J->P
2024-04-24 12:33:30 UTC	16384	IN	Data Raw: 04 27 0b 62 19 ee a6 9b 7b 8f c3 22 1a a1 95 6a 92 62 f0 6e 0c 25 bc 84 6b e8 7b 38 d4 c6 53 1a e5 35 70 94 6a 84 dc 46 23 6b 2f 43 77 70 04 16 da 5a b5 a7 14 0d 5a 70 47 59 ff ec e8 82 a5 1c 0d 87 04 e3 e4 b0 a5 97 8d 2b fd 20 03 47 eb 03 9e d8 19 fc cc bf 43 e5 6a 70 b5 17 9c 4c 43 d2 5a 12 0b 4e 6c 59 33 97 e4 fd b7 49 4e 80 74 bc c4 d0 1b b2 95 a9 e3 e0 6b fc 08 aa 66 09 43 47 a3 de 63 e2 e6 9e bb 4e 04 ce f6 e9 eb 2a 98 1f fa 13 15 20 f4 34 6d 81 60 bb 31 21 d0 f2 63 2a 6a 78 b8 95 94 4a cf a0 fd 79 e3 0a 0d 5d 30 d4 e9 86 f8 3e a8 35 09 7f 58 1c 72 f2 f2 36 56 8b 4e f8 b0 9e d2 a7 fe 55 8a 72 de 1c 20 10 49 6d ac 1c 18 cf 5e 75 b6 2d a6 24 75 cc 48 b3 7c 26 9c 36 d9 db cc 53 d5 a7 09 86 d9 b3 58 f1 cc 06 e7 42 a9 8f e4 b4 f2 6e 72 a8 33 0b 45 69 61 Data Ascii: 'b{"jbn%k{8S5pjF#k/CwpZZpGY+ GCjpLCZNlY3INtkfCGcN* 4m`1!c*jxJy]0>5Xr6VNUr Im^u-$uH\|&6SXBnr3Eia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49813	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:31 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:32 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: KjNo-jI0JLFIkPMnFW6MObzg_qh496A3hJ_r4QG0HnJ2NeMUx8cvEQ== Age: 104
2024-04-24 12:33:32 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:32 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49814	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:31 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:32 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 a4840d65c9b0feceec7a77f10199d82a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 2MkBmvUYe7Jz4xog9zeSjLgbEQBYhe_OMqayFqzolBtAzqefiEjyLw== Age: 109
2024-04-24 12:33:32 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:32 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49816	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:33 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:33 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 67457a1c6fa65adb25b9c8de1fddc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: I1K8Jo1LM2UG0777IaLgpgoRBLQrIZZWtQOE4UYWok41nhyG0Rke-g== Age: 106
2024-04-24 12:33:33 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:33 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49818	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:33 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:33 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 9fa56be62b1be7dd446abf03b1b07c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: SdHVLDQuE3ROLpe7peNKIhyHOoEZc-e_QAH8PUyMS8hbO_52D73xBA== Age: 110
2024-04-24 12:33:33 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:33 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:33 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:33 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:33 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:34 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:34 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:34 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:34 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:34 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49819	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:34 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:35 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 8b7ef769fc2c91a0e16129302042a4c8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: F0km0KXE2cBg8umYMevfcxey33o0PnVOMC4HMN8SnKnMmP-UGcf0kg== Age: 108
2024-04-24 12:33:35 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:35 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.16	49820	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:34 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:35 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: jm6I5G8TzAmZnDJEqg6P_QNOnR_WNyg0U2W8lEzZ9RaCnm-t-UFmhQ== Age: 112
2024-04-24 12:33:35 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:35 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.16	49822	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:36 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:36 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6fb7d4787cc656b14713661951c985de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: 89dPC7lB0wNYx61O2H9Nvo02fTOEbS1AgGDsB47v1RS4O7KIWpHaog== Age: 109
2024-04-24 12:33:36 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:36 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.16	49824	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:36 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:36 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 250c0cb00d06687b06322aeb6c0379f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: ZpmSdWg-B-bVG_S1GNxQUkfK3r5cRUtB20zMCl_6MMWi6lfmVeej_g== Age: 113
2024-04-24 12:33:36 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:36 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:37 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.16	49825	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:38 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:38 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 1c5a7e2dbc29e2ce87f40dbbc168a96c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: Er6JFGTmG-q4kfc9pAyyuuxqUlbqDdemRu-z-mHrp-s7Iv6ZmTu_eQ== Age: 111
2024-04-24 12:33:38 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:38 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.16	49826	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:38 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:38 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 2d00df3f936d7626d50853ebd0e73b30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: b8s2KaY02LMa-BWBeozwA1cu3JJN9VSjTGfBFIyr5Nc85CI26xseHw== Age: 115
2024-04-24 12:33:38 UTC	3064	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: be fb fa 79 5b 35 3b 06 82 11 c9 5d ec 07 c9 ea 3a 02 3b 74 14 6d 99 30 76 59 1b 6f a1 3b 80 39 92 dc e4 2e f5 74 41 7c 68 30 b0 2a 84 a5 ea d1 33 5d c1 24 00 cb f7 b8 a4 72 69 5b c8 0b 03 02 18 5c 8a c7 b1 b9 ad d7 11 72 f6 75 4b 58 21 a8 27 57 1d 16 72 9a d6 1c 90 21 96 85 77 b6 26 36 15 90 48 26 69 6c 17 2f d2 73 36 8c 23 b9 ce 76 6e 46 9a 0a d6 21 27 f9 41 79 92 aa 3e 76 55 57 4e 75 12 1c 45 37 ce 09 4f 4f 9f 29 83 71 1d 15 38 5b ff 80 a4 f6 4a 6f 63 a3 df 70 f8 25 3b 10 8b d7 d1 04 5a 12 cf 1c 07 35 2e 01 60 c8 fe a7 1d cb aa 90 e9 4b 08 0f 6c 1a 71 27 b3 a4 2a 97 48 eb b8 3d 35 dd 4e 55 61 91 33 d5 7a 29 98 0a a7 36 c4 13 fa d9 e8 78 48 92 33 c3 ce 70 84 88 c9 39 3d d9 ed 95 12 4e d7 40 f6 34 74 3a f4 37 cc ba 65 d4 7a b6 a4 2c 25 8e 0d 54 d7 32 e7 Data Ascii: y[5;]:;tm0vYo;9.tA\|h03]$ri[\ruKX!'Wr!w&6H&il/s6#vnF!'Ay>vUWNuE7OO)q8[Jocp%;Z5.`Klq'H=5NUa3z)6xH3p9=N@4t:7ez,%T2
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: e7 10 ae 87 0c af 0a 8c 55 16 0f b7 b9 ce f6 7c 7b 4b 49 7b a7 57 d0 e8 52 08 f4 ad c5 ac a5 16 60 0e 73 b8 e0 6e 1c 91 5c 4e ca 5a 20 ae d5 18 d7 14 86 2c fd bd 54 7a 00 1f f4 e7 66 2e a0 3b aa 7c e4 4a 63 ba 33 e8 10 5d 0c 00 86 ea b5 07 b9 cb f7 7e 35 94 76 3c 90 e9 f6 53 1c 52 a1 62 e3 7b 0f df 94 a4 20 bc 59 e7 6f 56 82 74 d6 15 da 05 ed 01 bf d8 81 11 a0 b0 c8 c4 c1 2d fa c1 a3 c2 07 33 01 8a 52 06 71 95 28 a6 fe 1a f2 d8 ea 10 3b 32 83 ac 00 00 d0 ee 1d 39 71 a3 31 c2 20 ca 70 0b 92 bf c1 33 7c 5a 5b b8 64 5d 57 3f 5f 69 cd fb c5 8d fd 5f 19 ca ed 7d 5a 45 a1 d0 64 0e 95 4c 02 33 35 74 38 40 df 82 7e f9 97 07 65 81 9f e0 61 ee 55 85 a9 9c ef 2d 50 72 b9 bd 11 8c cc 0a 42 98 60 1c c6 57 01 25 5e 1e b5 43 99 17 0c 6e e5 f9 0f 6b c1 65 da 70 f4 59 41 Data Ascii: U\|{KI{WR`sn\NZ ,Tzf.;\|Jc3]~5v<SRb{ YoVt-3Rq(;29q1 p3\|Z[d]W?_i_}ZEdL35t8@~eaU-PrB`W%^CnkepYA
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: fa 19 d7 4b f7 2d 54 56 c6 d4 67 36 51 9c 36 3d a2 a1 76 62 1d a1 4a 9d 1a bf be 38 77 2d 6c ce 6e c4 26 ab 58 87 8b 07 1d 9c 3b 0e 52 46 29 39 c3 6e 8e 66 a8 0f 8f 79 18 df fd dd d1 72 fe c1 f3 2c e5 1a 9f 4e 74 69 9a 3f a4 94 2c 5f 15 b2 3e 5a ca 85 50 ab f0 c0 47 38 dd 41 01 58 44 c3 42 05 3b d2 01 f0 22 f0 fe ee 78 2f 22 48 1a 42 ba 6d 6e 0b 35 97 d8 77 57 a6 7e a1 01 56 ff 58 92 75 20 0c c5 89 d8 e1 a4 3c 56 6c 5d 5c 18 3f 2b d9 3b ab 6b d4 da dd 76 de 8c 9e d0 5e d0 e4 64 88 dc f7 5c a3 a2 c9 e3 d2 5f 4c eb 81 58 f4 2a 35 04 f8 78 42 3b 04 1b dc c5 d0 27 12 b4 1c 8c 4f a5 69 7e 6a b8 52 cd a6 23 b9 a8 4d 74 90 14 93 48 48 84 d4 2a c5 c9 98 5d 38 77 ab 4d f7 b2 6a 7c dc 13 c8 42 40 32 f7 bc e3 13 eb db a2 b2 15 0c 73 67 9d 2e 4d 99 14 8f 81 ba e9 5d Data Ascii: K-TVg6Q6=vbJ8w-ln&X;RF)9nfyr,Nti?,_>ZPG8AXDB;"x/"HBmn5wW~VXu <Vl]\?+;kv^d\_LX5xB;'Oi~jR#MtHH]8wMj\|B@2sg.M]
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: 5c c0 13 fa 5b c8 83 85 bb ad d9 12 2e a0 0e 6a 3e 42 a4 9c 8c 17 16 01 2d e9 0c e6 69 d1 6d 33 b6 58 3b a9 2f 65 04 51 67 89 48 3e 20 9d 03 c5 44 19 b6 bc 97 e7 5e 60 b4 b7 6f d9 37 e6 36 af f9 77 0a 81 ea d9 6d 60 09 b6 aa 85 54 2d b9 49 18 92 8c 6e ec 0d a6 da 7d 67 28 9a e4 92 64 22 12 3e 9e 78 4e 89 a9 cc 06 8c f1 c5 da a7 d5 2b ef c2 3f 54 68 4c 20 2e a2 66 7e 91 39 62 14 56 69 1d ae c9 0b db 1a 01 fa be b2 8b 89 fe 5a 52 d6 ec 74 bc 7a db a5 5c ec de 06 94 82 83 88 c0 b1 64 e7 2f f2 ce 59 42 f6 16 e4 9c 52 b4 00 a8 0a 8b 0c 9c 2a d9 06 5a 5e 84 03 eb a0 3f 1c 33 53 69 48 3f 61 2b 44 f2 8c 6e 23 44 b5 e8 79 66 d3 38 d6 d3 9b 90 7e 30 87 66 61 53 e0 32 5f 83 fa 55 3b d2 46 e0 44 93 78 18 5a ea 0d ca 88 12 72 77 27 9b 08 9f c7 f6 9c b8 de e0 33 8f c8 Data Ascii: \[.j>B-im3X;/eQgH> D^`o76wm`T-In}g(d">xN+?ThL .f~9bViZRtz\d/YBR*Z^?3SiH?a+Dn#Dyf8~0faS2_U;FDxZrw'3
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: 01 28 8a b8 ef 7c 58 f0 d1 d5 10 cf f9 f9 81 0c eb 8c ad 8b 0e 7f f3 0d 9e 8d 81 b4 7e 2b 6d de f3 fe 3b 23 ba 1f 27 f9 60 fd c6 99 76 47 84 d2 28 a9 68 8d d5 74 35 5d fa 2e bb 31 05 71 08 90 4e 09 5e 96 87 f0 f5 e5 0b 36 78 a4 0e 97 57 6e ba f7 80 47 b3 c2 4e 56 5c 8e 5f fe ff 8f 27 06 c9 1d ef df 5a 25 16 e2 76 fc 5c 01 91 9f 1f e3 32 f9 61 1c 5c 69 c1 46 8d 6c 20 81 13 f1 57 69 32 37 23 4a f0 76 95 5a bc 66 ea bc f8 c5 d4 41 94 46 a3 ac 4d 6a 0d fe 6f 97 4d 69 1d 47 ca 08 57 76 a6 93 27 b7 09 03 46 dc 89 8a 68 d4 7b 02 6e ba 0f ec 0c 51 37 39 af 8f 3e 0b 0d f5 89 c9 a5 5d 61 d2 22 c5 99 85 30 1c 17 4d c5 b4 eb ea 3b ca 76 41 ac 66 48 a8 34 d4 3b 08 20 a7 5f 05 95 f5 68 3e 76 00 9f 67 46 64 b4 fe 72 fc 8d bd 30 0e 31 32 d2 ca f8 1a 10 15 2d 00 9c df da Data Ascii: (\|X~+m;#'`vG(ht5].1qN^6xWnGNV\_'Z%v\2a\iFl Wi27#JvZfAFMjoMiGWv'Fh{nQ79>]a"0M;vAfH4; _h>vgFdr012-
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: 5f 47 8b 4e 30 e2 6f 2e 86 20 85 56 19 48 ae 34 77 ce 97 d7 8c 03 60 61 42 99 0b bf d9 ea ca 67 a2 81 37 3d 6f 8a 8f 17 60 73 1d 5f a2 cc 93 fa 6f 58 29 9d c5 e3 e0 5c f3 f7 ae a0 31 54 73 3a 0d 45 ee 76 67 17 26 93 e2 b6 0b d0 e1 4b e0 a0 61 02 36 69 ca b5 05 b2 27 f3 40 a3 d0 42 6a 5a f3 8a 24 da 06 22 ea 5f a7 83 3e a4 9b d2 56 26 43 05 9e d9 8e 0d 60 73 72 32 59 93 11 9f 07 00 51 ec e3 5f 0d 1d 3a 3a 50 96 22 3e 49 97 89 d7 4c c7 a3 ee da a2 a7 c4 3d 37 0e db c3 0a 8f 0c 17 fa 05 11 57 f6 33 e8 39 37 7e 8d 7e 7c 78 e9 9e 3a a3 80 56 69 14 01 ee 7f 81 d3 55 4b e6 71 37 06 b9 0d 84 cc 32 59 69 54 23 60 f7 82 37 29 6b 7c 5e ea 7a 36 32 6f ba 1c 5d 53 35 c0 d7 4e f2 01 ac 73 16 4a 5d 62 aa a9 8a c4 c1 f5 7a 39 d5 f7 29 6b 69 b4 0c 9e 74 eb 2c b7 ac 96 07 Data Ascii: _GN0o. VH4w`aBg7=o`s_oX)\1Ts:Evg&Ka6i'@BjZ$"_>V&C`sr2YQ_::P">IL=7W397~~\|x:ViUKq72YiT#`7)k\|^z62o]S5NsJ]bz9)kit,
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: 82 60 aa d8 ae 6c 72 4e 05 9d 84 b2 08 b8 3e c6 c6 53 4e 64 71 62 2c 6f 09 d5 a3 79 cd cd 9c b1 f1 fa 57 e9 55 d0 21 05 a9 d3 d7 76 ec 71 ed f9 0c a8 0a bb 54 ee 34 72 2b 43 ea 27 aa f6 6a f0 a2 97 28 9a 5b 4f da 4a e5 81 44 01 cc 53 2f 3b 03 5f 7d 28 7f 82 23 19 96 4c 82 af ef 52 2f e0 c4 ec 3f 1a 2c 0b da 9f a5 82 5c c6 14 43 fc aa 4e 53 07 1b 6c 4a 7a a8 ae e7 00 f2 b3 a8 7e 97 ec 08 2b e7 33 ce 18 8c c0 7b 74 7b 61 e6 02 6a a9 03 b5 1e 9c 72 d6 1c e9 0b 17 94 82 88 8f c9 fa 56 0e 1f c2 3d 0c 9e 86 ad 1d 8d 52 26 c6 2f 07 0d 9e ff a8 fb 45 a7 2a e8 06 fb 3b c3 2b 88 de 55 c7 2b 20 6a 1e a9 89 3a 47 ae 79 07 fe a4 35 e8 75 15 26 8e 66 5e 68 78 8d 83 ca 21 d9 4b c2 b5 cf 4c b3 3d 60 33 ea 80 da 02 0c 62 41 66 34 10 1b 20 f1 48 c2 ea 1f 3d d1 ba 97 fd 7d Data Ascii: `lrN>SNdqb,oyWU!vqT4r+C'j([OJDS/;_}(#LR/?,\CNSlJz~+3{t{ajrV=R&/E*;+U+ j:Gy5u&f^hx!KL=`3bAf4 H=}
2024-04-24 12:33:38 UTC	10034	IN	Data Raw: cf 59 10 52 cb c1 6b d9 f1 fc 84 ec 60 e5 0e bd d8 dd 87 25 04 e6 fe 8d 4b ae 56 1a 70 e5 e2 5d 5e fa 09 3f d7 3c b5 05 f2 e3 dd f6 63 27 f0 fe 70 24 de 48 2f bb 79 29 27 32 6d 13 66 71 e9 ef a1 0e 60 ad 29 be 58 75 09 03 66 93 90 2f 43 36 6f 60 51 cb 8b c2 35 7c c7 71 28 07 ea 88 d1 9b b6 44 9c 24 23 28 39 ad 55 ee 4e ad 10 29 9c 84 f7 45 5c d9 89 16 5b 3a e9 46 8d 4e 9e 58 ba 1e c9 fb 17 08 c3 0c 0f 01 ef 8f 8b 1a be dc db 6b 3a 4c 8a 9d 93 b0 b9 e8 8b 94 b5 3c 26 be ba bd e5 8e 73 d9 b0 42 7e 58 e5 6f 92 cb 25 fb 1a 8b be f5 75 9f 99 0c 97 06 3a 58 36 dc d4 d4 ab c6 e8 53 c4 fa a4 71 ba 41 a8 6f 10 fc f1 93 72 d6 17 7b 40 1c e5 42 3c c2 49 1e 87 8e b7 e0 a0 bc 9c b1 81 ff 68 4a 5c c4 dd b2 a7 64 70 85 55 2d f8 16 96 b9 f7 c2 00 ed 4c 9b a1 45 f6 4a b5 Data Ascii: YRk`%KVp]^?<c'p$H/y)'2mfq`)Xuf/C6o`Q5\|q(D$#(9UN)E\[:FNXk:L<&sB~Xo%u:X6SqAor{@B<IhJ\dpU-LEJ
2024-04-24 12:33:38 UTC	16384	IN	Data Raw: 8b fe bf d0 b1 0e bd 0f e3 5a bd 9f 4e a4 b2 45 a0 10 57 60 43 17 3d 51 c3 74 f1 a7 a7 d5 56 67 ab c5 30 bf 20 58 bc 81 e4 66 cc ee ca b9 ff 0a e9 f6 55 68 b3 9c 54 99 51 35 2b 88 c5 ea 7f ea 63 3b 27 40 2c 1c 0b 7f b2 08 e3 e5 83 e3 41 d9 6a 13 07 e1 d6 c1 8a 08 1e fd ef 16 72 05 a4 d5 53 7a 03 e7 5a 7f 32 57 cd f7 43 01 36 6e 98 f4 4a 9a 4e d2 33 59 cb a3 81 40 9b 5e 92 72 53 ba 72 95 76 85 2c 4d fb 08 46 c8 21 e5 ac 34 7b 84 e2 09 c3 49 97 48 9a 6e 8e 28 3c f2 ee da dd 4a a5 58 82 a5 ed f5 45 ba 3f 2d d8 2a ee 57 9d 3a e0 c4 d9 0b ab 6f 98 f6 85 ab a1 59 68 24 d5 44 ba 4c 91 a0 0e 5d ac 3e 3b 22 eb a9 87 25 10 f9 ad 07 e2 d4 77 fe e2 cf 8d 9d e6 ba f4 7e 40 a1 b8 74 ac 9c 1a 6c fc d4 75 79 d9 9a b5 a0 44 1f 15 a5 50 d9 66 87 ab e8 2e 48 3c c4 9e 85 82 Data Ascii: ZNEW`C=QtVg0 XfUhTQ5+c;'@,AjrSzZ2WC6nJN3Y@^rSrv,MF!4{IHn(<JXE?-*W:oYh$DL]>;"%w~@tluyDPf.H<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.16	49828	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:39 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:39 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 029709435e1da82d2fcf38cfaa581f38.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: P-jKGXHRHaVrOgbuBGd5arHjDV3Xx2_-Jzb8tIYB9h8VJnYmnj2H7A== Age: 112
2024-04-24 12:33:39 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:39 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.16	49830	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:39 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:40 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 a4840d65c9b0feceec7a77f10199d82a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: BN4bZwUIu_7IRv1KzNN4SHt42uBQiA1Mj_vtgDQG3B_aWugCGHIzZQ== Age: 116
2024-04-24 12:33:40 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:40 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.16	49831	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:41 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:41 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f26dfbe988a7b848996c166e29cfa8a2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: yzgp5M_9KntU3e5caa7dhBu4hA4NNkVCUkRsDG55Djh8XavE6b2THA== Age: 114
2024-04-24 12:33:41 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:41 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.16	49833	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:41 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:41 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 9fa56be62b1be7dd446abf03b1b07c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: Nwd_X37xqWjwdss-W9-3EfQWqjkBJPjIx-wnEk1_XZidZWecmZ5wFw== Age: 118
2024-04-24 12:33:41 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:41 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:42 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.16	49834	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:42 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:43 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f781ef6ca1647978bf98d972dc06ed4a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: WJq7NqLRVMTCayCHmzk-7h2GAT1zzmSPoBgKij2d0Mo46OqgU7fhpQ== Age: 116
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:43 UTC	12738	IN	Data Raw: 2c 5b 9a 28 a9 76 bb ac 38 18 bf ad 18 b6 7f 73 8b c5 c5 eb 94 fe c7 e0 22 07 ee e5 fd 9b 17 44 27 6e 2c be e8 9f fe b1 b5 73 97 4b c3 4b 00 10 0c d0 02 b8 07 3f 01 bd a0 42 43 f4 5c 85 de 2c a3 03 49 47 8e 7e 58 4d 0a b9 54 b2 92 3b 00 4f 1e 19 2d 96 71 a6 35 e4 ff 1f 9e c7 e2 b3 6b f2 40 39 92 4d e4 74 8a 13 0d fa f9 d8 8d 1c 10 72 b5 65 00 51 33 73 f1 e7 d8 38 8a 52 81 83 9a e9 df 4c 3d 3b c2 77 a1 ff 2a ce 74 5e f2 02 1c b9 3a ce 68 8b 38 81 28 c4 54 35 2d 80 de d9 00 74 17 9e 04 1b 7f 41 ec 37 7d d9 b6 98 d1 c7 b4 c6 3e 25 66 73 9a 69 14 f6 b9 4c 03 b8 bd a2 50 56 ae d5 68 45 b6 90 8d 9c 35 5e 21 57 fb 06 05 27 50 a4 e8 6c 68 46 d8 a0 0b 22 80 9d e2 a0 96 ac ec fe 77 89 15 da e0 e1 65 7b 52 c6 bc ed be 79 a6 3c 3c 6f c5 0f b5 86 ac 9c 16 95 83 3d fa Data Ascii: ,[(v8s"D'n,sKK?BC\,IG~XMT;O-q5k@9MtreQ3s8RL=;w*t^:h8(T5-tA7}>%fsiLPVhE5^!W'PlhF"we{Ry<<o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.16	49835	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:42 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:43 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 6be51685f3d6c8586915cd0d829c6d14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: VDYfRc6EhYLFhTnaPfwq3QjmeqYHe6lrtoqUhur6twN-lLrJSfWkFA== Age: 120
2024-04-24 12:33:43 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:43 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.16	49837	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:44 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:44 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 b52326df4756bea63ef29096752f3330.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: DljviWkmWHaRUjy_Kp-uJCPRvg5bvfghQU7IYTsfE_4qEAe8JnBCOQ== Age: 117
2024-04-24 12:33:44 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:44 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.16	49839	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:44 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:44 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 9fa56be62b1be7dd446abf03b1b07c74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: EGMmNw5GxYj3NhnCA6mSlcJZQITQQv4HhlBEHmcFCdOMEQivP7tFxw== Age: 121
2024-04-24 12:33:44 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:44 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:44 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:44 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:44 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:45 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:45 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:45 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:45 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:45 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.16	49840	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:45 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:46 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 e6b6e5bd4ef6b9f2229ba5086dfcbb0e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: c9Ir39s0kBkgLTkU8zlI_aO4Etsq0McHV0UkY9TX0mTcI2_tDB8g-g== Age: 119
2024-04-24 12:33:46 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:46 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.16	49842	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:46 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:46 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 9c75a2f695ad1c7a78bd2b623f5a2762.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: I4yRyTbMULYDoyQXWYEpz-N3FqnbQTAUBoj2HIVWxIvU9D5OGRp6Iw== Age: 123
2024-04-24 12:33:46 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:46 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.16	49843	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:47 UTC	201	OUT	GET /compressed_assets/poker_bet365_com/templates/installer/new.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:47 UTC	470	IN	HTTP/1.1 200 OK Content-Length: 29122 Connection: close Date: Wed, 24 Apr 2024 12:31:48 GMT Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT ETag: "844817ca2e3c1e633f41ee03ffc052bb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 709a1e6d45446b539d00ae49408d0988.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: wQLiJSAS7tVbtmbrcIubllbsH6yVqpExKsI0VDC7wp6xtWr3fWyApQ== Age: 120
2024-04-24 12:33:47 UTC	15914	IN	Data Raw: 37 7a bc af 27 1c 00 04 58 11 d6 6d 7e 71 00 00 00 00 00 00 24 00 00 00 00 00 00 00 3a ce 78 88 1a 85 68 95 95 b3 60 9c 9d a7 ec 92 66 cc a2 72 68 d4 92 a1 4f a5 c2 2e 6e 56 aa e4 6b d1 5b a5 1c 7b 40 73 95 41 56 98 85 d5 5b b4 a0 fb 4a 7b 12 29 89 df 19 83 9d 1a 6d a1 0a 6e 5b af ac f9 3a e6 d1 45 75 cb f9 19 e5 60 36 46 8a fd a5 b7 ae f3 29 ff 69 c7 a0 d3 51 cc 4a 2c ae 62 6b 7b 3e 61 ed 7c 8c 4b 62 93 52 62 90 9d 12 a7 cf 7c c6 71 57 e4 07 24 f2 cc d0 22 2f 95 24 4a a9 f2 a7 10 e6 4e a9 5d 85 3e d5 8c 42 bf f6 84 fb 91 0a b1 eb 46 42 17 66 ff cb 46 ea 07 bb 91 d8 f8 44 67 f1 69 9f a9 a0 95 38 29 f8 ef 1a 74 22 87 f9 e4 9f 3d 16 99 1d 45 96 2e 5a dc a9 81 80 24 97 b8 a3 0d 1d 80 bb 5b 0c bc f0 2e f8 21 cb c3 2f 31 ac 1b d0 fa 16 be 62 2d 67 4a b4 4a 2b Data Ascii: 7z'Xm~q$:xh`frhO.nVk[{@sAV[J{)mn[:Eu`6F)iQJ,bk{>a\|KbRb\|qW$"/$JN]>BFBfFDgi8)t"=E.Z$[.!/1b-gJJ+
2024-04-24 12:33:47 UTC	13208	IN	Data Raw: ae 4e fb af bf 07 f5 7f 3d 0a 2b ec b4 2c 1c f8 f7 36 e9 7c 7d c5 20 03 80 79 43 bc 3d 3e f9 bf 0c 27 a1 a5 d0 af cb ee e1 bc a2 d8 cf 5a 4e 58 85 d8 13 8f 4e 74 d5 77 bb 08 bc e3 39 ac aa 7f e8 bc 37 74 f7 36 0b c0 71 c6 08 81 3b d8 3f 66 9d 26 12 f0 98 c4 3c 27 cf 8d bd ac e1 8a 5b d4 a3 6f b3 6b 3a b6 4a b0 b5 1f f6 1b 09 bc e1 57 3d 0f ec d2 5d 4b 86 aa 40 37 7b e5 ef 56 ac 63 1e d1 a5 a0 69 f8 98 b4 49 ab 4d e9 83 3c d1 70 03 2a 65 a0 3c 1a 9c 31 df e6 90 a7 3a 75 2a bb 4f 65 0c 89 f7 cb f0 78 d0 b6 24 31 2b fe 10 c2 28 63 7a 02 47 6a f6 95 3e 0a 30 f5 5a 18 af 79 ee bb 18 39 74 9c af 3f 8b 70 5c 33 8f 69 1b 7f 30 f7 3c 64 70 66 bf 2c 39 64 ec db c5 0f d9 f8 e3 0e ab ec 6e e8 c0 6b 2b b1 d1 84 55 98 85 3f 5c 33 5b 22 e3 15 1a 50 77 ff f8 f5 53 1f ff Data Ascii: N=+,6\|} yC=>'ZNXNtw97t6q;?f&<'[ok:JW=]K@7{VciIM<pe<1:uOex$1+(czGj>0Zy9t?p\3i0<dpf,9dnk+U?\3["PwS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.16	49845	52.85.39.184	443	7012	C:\Users\user\Desktop\SetupPoker.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 12:33:47 UTC	183	OUT	GET /compressed_assets/poker_bet365_com/index.7z HTTP/1.1 Accept: / User-Agent: WinClient Host: d3a6p9a3vksur7.cloudfront.net Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 12:33:47 UTC	471	IN	HTTP/1.1 200 OK Content-Length: 325970 Connection: close Last-Modified: Mon, 24 Oct 2022 12:19:42 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 12:31:44 GMT ETag: "dabf9ef79326a6b036bd65b39a7ffab3" X-Cache: Hit from cloudfront Via: 1.1 67457a1c6fa65adb25b9c8de1fddc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P2 X-Amz-Cf-Id: QWaz2ahBdVIM-B-pL3sS1aCRLMpcUvBCu6GWNnsF1KaikZKEs_minA== Age: 124
2024-04-24 12:33:47 UTC	15913	IN	Data Raw: 37 7a bc af 27 1c 00 04 84 87 51 21 b0 f8 04 00 00 00 00 00 82 00 00 00 00 00 00 00 9e 42 d0 ce 7c 20 ef 31 57 fa b8 5e 94 fb 82 70 40 f7 a2 f8 08 6f 99 0a f1 61 9a 83 b8 43 ee 4c 7c bb 58 52 58 10 2b bb 88 29 ee 0a 20 57 33 b0 8d af dd 89 79 eb 41 69 60 dc b3 94 56 6c 82 ce 9c ef 15 0d c9 52 22 a0 6e 80 b6 cd 22 f7 74 6c 2f 18 e0 f1 44 77 07 b8 77 c8 1f 36 c3 d2 0c ad 6f 5d c5 a7 cb 37 83 f6 94 53 da 74 06 39 48 34 1f 32 3e 4e c3 d1 fb a3 de 8e 75 9d 1b a5 bf fa 81 a4 3b c6 3e c2 86 93 1d 2b c5 57 ce d9 79 17 b3 69 70 13 da b8 d1 aa c9 13 fe c2 9f 6d 84 51 87 31 03 7b 8c 16 b3 66 c0 db 85 f9 b0 cf 8a a8 4c a2 c5 47 33 29 f1 cb 02 03 29 5e 6b 06 e1 66 6d f8 72 6a dc a1 3e 73 f3 db 71 f8 70 13 68 18 c4 23 e9 8d a8 db de f4 a5 cc 5e f3 48 42 c8 b5 7b 2e bd Data Ascii: 7z'Q!B\| 1W^p@oaCL\|XRX+) W3yAi`VlR"n"tl/Dww6o]7St9H42>Nu;>+WyipmQ1{fLG3))^kfmrj>sqph#^HB{.
2024-04-24 12:33:47 UTC	16384	IN	Data Raw: 2c 29 c8 9d d7 cc 85 a6 93 a6 31 4a b0 3e 3f 97 12 36 00 ed 59 e2 84 7f cb 6e 8c 9d e5 13 65 c8 1a 42 38 6d 3d b5 a5 4f 2a b9 1e 21 75 5a 7e 53 4b 09 63 91 fc 2d c0 1b 4d 5e d0 cf 47 e9 7d 14 09 ab e0 7f 25 e1 58 31 dd a2 ac 1e 6c a4 dc a3 fe f1 75 22 4e 2c 84 92 9b b2 bd c3 c9 b9 90 e6 21 fe 29 93 12 2c b9 26 ae 82 c4 2a 92 37 3e 0c 9a 84 18 4a 63 ca e9 a9 94 0b a1 29 da ba 10 b6 4e b7 cb 99 a1 19 4f c1 e7 d6 aa 36 93 8e c6 12 6c 19 84 d9 cf 45 a5 5b 15 85 4a 9b 59 33 99 91 38 82 94 31 d8 92 32 66 e2 1b eb 78 6b 8f 45 31 32 09 00 d6 00 ee 21 83 92 14 2e c8 5f 4d 0a b9 5b b3 56 31 d9 e4 7f bb fa c3 2b 0e 9b 4a 60 14 26 30 81 f8 ae e7 cd b3 be 61 39 7a 2e 63 83 91 de 2b 53 66 b5 67 11 b4 52 51 05 36 dd 13 22 6a 47 75 e3 47 04 a2 00 e7 57 99 03 2b 5f 1c b8 Data Ascii: ,)1J>?6YneB8m=O!uZ~SKc-M^G}%X1lu"N,!),&7>Jc)NO6lE[JY3812fxkE12!._M[V1+J`&0a9z.c+SfgRQ6"jGuGW+_
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: e5 74 55 10 24 f2 01 21 8a bd 31 67 4f 94 4d 7e 3e f1 12 77 69 69 f2 93 1c b8 38 93 7d c6 0c c3 bc b3 3c f7 8f 34 91 96 e5 4d 8c dc 3e fe 04 48 23 6f 6a d6 01 48 e2 2a 12 7e 8b 18 e6 05 d5 7d 28 98 48 03 f8 30 86 eb 37 11 a4 62 64 d0 0b 0f b8 96 78 9c 3b 2e 74 1e 9e c0 07 f0 83 ab a4 28 22 12 7e c2 4a 44 60 0e 1f 64 9c 91 aa d8 07 1e a3 a7 87 be 7d 36 12 91 0c a9 3e b6 c9 73 e7 a4 4b b9 a7 ea d7 17 90 a0 40 ed 48 11 d0 73 08 d3 bc ca 3d a1 35 b3 41 46 bb d5 78 69 3c b5 99 92 56 53 22 cc 33 f5 7a bb 11 17 01 55 ed 28 04 ab c9 b7 de 5c e7 1e c0 1e ea 65 3c 72 5e 8b 0d 67 00 02 d8 01 8f 3c 4c 0a 77 2a 57 6b e4 af 0e ed cf af 77 6c b9 f9 43 bb 70 43 8e c5 d0 c2 5f d6 44 79 b9 c1 1a a3 b5 fa cb 1d 6e 4d c3 b5 b6 2e 06 cf 87 b7 3a 16 dc f3 f6 35 dc 8b b8 81 28 Data Ascii: tU$!1gOM~>wii8}<4M>H#ojH~}(H07bdx;.t("~JD`d}6>sK@Hs=5AFxi<VS"3zU(\e<r^g<LwWkwlCpC_DynM.:5(
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: eb 47 f1 d9 78 cd a5 78 02 ec 8f 22 da c8 43 a2 bf 78 22 e6 34 cf cb 5c ce c1 8b 78 e8 af 4e 87 d5 4e c9 1c 6b be cf 36 cd 89 f9 8f 91 49 ca 67 05 aa 4d df ab d8 92 7f 5e 16 34 43 63 ce 0e 1c 02 16 3f 3e 00 7b 9c 7c 92 cf 2e 87 10 5a 2e c2 4b 0d 43 00 c4 65 0e 14 5d 2d 92 4c bc d4 49 6f 55 10 b7 6a ad 0b d3 47 31 85 c7 9d 9e 82 10 89 9a ce 65 d7 b1 9e 09 fe 88 6d 41 1c 35 c8 5a 36 c9 51 b3 48 4b 35 28 0e 5c 02 2e 6b cf 82 d1 03 e8 59 57 fe c0 bf 05 99 6b b4 f1 1d 39 1d f7 db b7 42 ef 6b 8f 7c 99 78 d8 ee f6 91 4e 24 35 b4 bc 62 f9 05 9a e0 fd c9 cd 1c cd 8a 77 d0 cd 7c 90 02 c5 b7 cb 9f 65 03 05 30 69 9b 0b 83 79 c9 2f 75 0b 71 e6 f9 a6 44 c7 af 9c 1d af 23 9b 9a bf 48 6d f5 61 32 e3 74 af e6 81 ab 4a 7d 18 f3 a0 45 06 15 3c 3e fb f3 e8 b9 e6 d9 1c a6 d7 Data Ascii: Gxx"Cx"4\xNNk6IgM^4Cc?>{\|.Z.KCe]-LIoUjG1emA5Z6QHK5(\.kYWk9Bk\|xN$5bw\|e0iy/uqD#Hma2tJ}E<>
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: d7 15 0a ec 04 2d 31 b7 7a 7e 7f ed 26 6e ce 3d f8 28 35 77 30 1f 40 86 a2 21 bf d8 6a be 52 0b b9 0b 88 83 9e 11 25 e7 65 e4 d6 85 1f 88 a7 13 0d 8a d8 92 d5 04 39 ff 1d 37 c4 ce b1 21 ee 71 58 f9 ce 4a e0 96 3a 9f 9e 32 46 b4 03 27 1f 76 d2 26 62 c4 62 18 35 50 e3 77 15 53 5b b0 a2 c2 b3 ec 11 07 ac d3 50 2d 37 36 62 29 b4 96 e6 28 68 90 77 ac c2 8b d3 0c 6e bc d6 bc 1f e0 c5 c9 2f 51 96 e7 fb 4c 38 8c 05 56 dc cd d9 b0 5c 11 4a 24 fc 00 e7 23 97 f4 27 12 06 f4 da 2b 81 ad c4 0e e8 2b 7e 3f a7 20 20 65 b1 6e 05 1d ea 9a 93 f7 9e 81 ec 57 fb 4c e6 28 ad 8e 97 17 34 fa 72 a7 41 df 8e 9a 25 e4 6e ca 7e 4b d6 2e 07 d1 78 bc d1 5a 5b b6 21 49 cc 47 b0 e8 d3 5f e6 1f 44 d9 0b 11 37 0f 14 1a e6 af 44 1a f6 74 4b 37 ae 6b 4c 2d b7 99 6f fd 72 35 2a 91 1e 10 31 Data Ascii: -1z~&n=(5w0@!jR%e97!qXJ:2F'v&bb5PwS[P-76b)(hwn/QL8V\J$#'++~? enWL(4rA%n~K.xZ[!IG_D7DtK7kL-or5*1
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: db 92 71 6b 06 7a 39 c9 5d 41 2d 7d ca 4a d3 8c 23 12 68 b0 54 7e 37 e3 23 3e 11 6c 7f 8c 17 a8 a0 fa 08 63 bf b0 96 20 6b bb 5a 80 82 71 4e 3c 49 27 dc fa d5 79 4f 17 86 b2 aa 4b be 65 ec 99 2c 9a 5e 24 7d aa a8 28 a5 ce 25 b1 f6 69 3e 00 c1 97 86 01 9d 1e 08 04 b8 3a b8 7d 32 87 97 0e b9 a7 de 75 7c ed d1 23 7d 5b ed 91 c3 7d 77 93 01 38 1f fd 68 0c ad de c9 17 b6 95 cd 44 ac 6e 55 ba 0a 1c 6a 31 b0 d1 93 22 d9 78 9b c6 24 65 44 08 28 67 ce ff 2c 73 c8 fa cb f2 e4 bb cd 2f b1 dc b5 39 56 5c 9f c5 16 4c 63 26 7b 23 ad b7 17 e8 96 1c bf 42 05 7f 20 8a 83 b4 34 70 50 85 b7 b9 d0 63 ff db ff 00 39 b6 80 58 cf 23 24 2d f7 d9 22 fc 6c 40 a6 79 2a 79 55 fa b5 22 fe de a6 ae d7 29 a3 b1 42 2f 27 f8 37 da 70 b4 86 0c 8c 6d eb 43 0a ca 97 90 07 e7 3b 64 2a 5d a2 Data Ascii: qkz9]A-}J#hT~7#>lc kZqN<I'yOKe,^$}(%i>:}2u\|#}[}w8hDnUj1"x$eD(g,s/9V\Lc&{#B 4pPc9X#$-"l@yyU")B/'7pmC;d]
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: 32 bc e3 d5 1c c2 c2 04 ce dc c1 e4 e4 34 00 a9 75 ed 83 32 ff 38 e9 75 90 6c 51 aa 7c 3b a8 75 97 d8 c2 d7 39 38 3a a5 d5 1e ff 61 b0 31 49 0f f6 c4 1b 75 ce 5f 1e 50 f2 92 7b 26 fd 6a 22 e8 97 71 de 61 ea 80 4d 9a ef 8a 16 61 f8 1c 96 09 c7 51 08 39 29 cd 94 4c 77 72 4d 5b 09 04 bf 5e 71 b6 b0 b1 0b 08 8b 9b 4d 95 5a 59 37 a3 a2 91 69 31 61 43 65 89 e7 9d 41 6e 28 1c 6e 95 39 55 a0 84 6c 7a 5d 5a d5 7e b2 6d ed 9c 04 4f 44 56 62 16 51 17 f2 c7 97 4f d0 ee d2 90 da 11 40 73 3a b7 54 34 db 55 b1 e4 bb ba dd c9 64 24 79 54 e3 98 32 52 87 5f cc 01 9d 4a fa 91 1f ec be 22 d6 b6 e9 c7 c1 e3 44 86 48 b0 0e e8 7c d1 11 3c 3b 0b 92 87 94 5a 3d 79 6d 53 d2 3e 04 21 63 08 5d 29 17 da 35 eb 0e f7 43 b3 68 8e cd bc fd e9 f3 dd c6 c3 9e da e0 62 08 38 6b df b5 6d a3 Data Ascii: 24u28ulQ\|;u98:a1Iu_P{&j"qaMaQ9)LwrM[^qMZY7i1aCeAn(n9Ulz]Z~mODVbQO@s:T4Ud$yT2R_J"DH\|<;Z=ymS>!c])5Chb8km
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: 1a a1 bc 6b e0 6c 9f bf c9 14 7f b4 c6 f1 68 f0 00 21 ce c9 f0 39 7f 59 e3 20 09 39 80 0f 8f 57 9b d0 60 1d 10 60 61 5b 0f 7b 1f 31 b4 9b 01 ed 24 ed f6 be ee cd 0f cc a8 0a c5 9f cb b4 23 87 77 f9 90 39 11 b0 59 a0 bf 5e f7 50 92 ca 16 dd 42 48 59 75 23 83 5c 13 67 90 83 06 da 99 1a fa fe 39 d0 c3 63 89 5d 8d eb 24 78 0e f6 65 24 6a b0 4a 73 9d b1 b1 cf 4d 70 58 32 25 6e c1 63 06 03 68 28 0c 3a 58 6e db 1c ff 61 1e 6b 4c cb a4 9f 55 d9 19 a5 90 d9 bb bb 8f 89 b1 f0 6b 17 c3 40 3e 95 8b e4 fc 45 b7 ac 3b cf fc 75 aa a9 04 11 ed 9d e5 ae 92 cd 6b 97 74 c1 76 5a 30 2f 6f ec 94 c9 d6 37 ad a3 52 dc 3c 5d c3 06 87 65 e3 df 7a 05 65 f7 be 1d 9a df e5 89 a1 22 6b b1 9e e0 02 1a 45 49 4d 39 f4 48 64 e4 e2 99 3b 92 d1 46 11 a9 75 3c 3e 31 b4 0f 56 93 b2 41 ea eb Data Ascii: klh!9Y 9W``a[{1$#w9Y^PBHYu#\g9c]$xe$jJsMpX2%nch(:XnakLUk@>E;uktvZ0/o7R<]eze"kEIM9Hd;Fu<>1VA
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: cf ea 8e 92 da 24 1f 9f 1a 4a c3 4b 31 c3 cc 42 65 f2 e6 fc 3c 72 89 19 a5 66 24 9b 52 97 7f b8 51 c6 0b a2 2b 86 47 d8 fe dd e4 eb a9 cb c3 7c 2e 0c 8e 1f 37 5c 22 2a 33 d2 0f e7 10 6e 80 78 42 b9 9e b0 b2 fa a0 bb ad c7 c7 5a ac c6 e9 6e 4a 09 8d 5e db 3f a0 5e fb 37 fa 24 e6 13 ce 00 c7 68 01 5a a4 94 12 1a 7e 13 ab 47 86 fe 1b ff 4d 41 1e 03 51 63 cb ac 8d 7a 63 57 30 7a e0 9b aa 25 05 fc 6a 68 73 e4 1c b4 aa ac 84 b8 a9 35 6f 9c 43 61 a7 d8 a2 17 df 6e 70 1c 27 af 4c 89 2b 3e 16 44 8b d9 89 03 14 6f d9 ee be e4 b3 9d 7f cc 2d a6 b5 69 bd 8a cc fd 5e b8 83 c8 f3 3e 4a d3 06 c0 56 9b 06 00 ce 37 fd 50 08 96 e2 d0 c6 f7 86 00 01 bc b1 73 76 0e 4d 22 fe 96 44 c8 e7 58 64 7d c4 4f 6c 40 97 f9 dd e1 09 6a 35 d6 25 8a ba 96 98 59 a4 c5 4a 38 53 7f d3 b6 68 Data Ascii: $JK1Be<rf$RQ+G\|.7\"*3nxBZnJ^?^7$hZ~GMAQczcW0z%jhs5oCanp'L+>Do-i^>JV7PsvM"DXd}Ol@j5%YJ8Sh
2024-04-24 12:33:48 UTC	16384	IN	Data Raw: 42 f3 24 6f 7a 75 50 cc 87 33 8d 4e ab 98 c4 6c 97 9e dc 66 ac 4b 2a 77 13 26 d2 93 bf ff 0e 79 85 e9 42 c0 ad 7c c3 18 94 8d 05 9e a6 15 44 7d 77 16 49 b7 b7 2d cf c5 ef 4b 08 99 9a 3a df f7 98 b0 aa 7d 47 05 ce b4 88 0c 71 0c 83 f6 4b dd 9e 76 58 7f ae 38 6e 20 1f ee ae 5f fa 4a 85 19 7b 12 75 57 80 57 55 85 b3 b6 ab 22 1f f1 43 ee f3 a3 e8 f6 33 aa 20 6a cd f6 2a 07 f3 7f ad 93 c8 c5 d2 f6 13 9c 0d 23 15 09 ad 51 08 59 ae 21 95 a5 e0 07 8a 94 e3 62 6c 3d 58 b4 0c 0d 15 a2 ee ba e9 34 b5 c9 80 8e 0a 5c 86 61 2e 16 03 ee cb a0 95 f6 a7 3a cf f2 2e 23 9b d4 f2 1c f4 14 7a 01 2d 5c 48 71 d3 05 08 06 54 b9 11 d3 e8 88 e9 11 34 f9 92 c6 0a 74 2a 9f 48 3e 53 2b e2 e6 55 ed a9 09 34 e7 84 13 3c 0b 3c 94 c5 0c cc 82 b7 72 28 2d e1 cd 26 c4 3a d5 ec 40 6b 84 f1 Data Ascii: B$ozuP3NlfKw&yB\|D}wI-K:}GqKvX8n _J{uWWU"C3 j#QY!bl=X4\a.:.#z-\HqT4t*H>S+U4<<r(-&:@k

Target ID:	0
Start time:	14:31:40
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SetupPoker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SetupPoker.exe"
Imagebase:	0x160000
File size:	810'528 bytes
MD5 hash:	343388C9516BC04F4ED06D6F1353F602
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0A6807EC Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1274636367.000000000A680000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a680000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624989632c422a155658960622d1d3f2c746d5e5ee3f33cf065505008835b6b9
Instruction ID: 47273bf81b0cbe5927ebf8507ffdff9d57bae85e5a8997973882a90459bbcef4
Opcode Fuzzy Hash: 624989632c422a155658960622d1d3f2c746d5e5ee3f33cf065505008835b6b9
Instruction Fuzzy Hash: 70F0B4F060C200BBEF356B54C594B70FAFDAF81305F074559E40A4B791C7B59C84CA50

Uniqueness

Uniqueness Score: -1.00%

Function 099D6573 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1498767089.00000000099D3000.00000010.00000800.00020000.00000000.sdmp, Offset: 099D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_99d3000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa008da7621a8f9239b7a7f8bf04db972d4689b90d06efbf4b491f9f1546e5e
Instruction ID: ac321702c66314633b992c8fb3fb0361de8bb87a41b00664c9924ab94dc581dd
Opcode Fuzzy Hash: ffa008da7621a8f9239b7a7f8bf04db972d4689b90d06efbf4b491f9f1546e5e
Instruction Fuzzy Hash: 3AE0123AB152189B9B00CA94ED858DEF3FAEFD8260F14415AF905E3310D670FC018AD4

Uniqueness

Uniqueness Score: -1.00%

Function 0A684580 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1274508053.000000000A683000.00000010.00000800.00020000.00000000.sdmp, Offset: 0A683000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a683000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29916bb825c6b9261617d56a75ee913fda9bd90a4ab4b82d9902a9746e2aaf95
Instruction ID: fd9ee31526fa61587614eb4f905c3491901c242136c129922df08213347f0cab
Opcode Fuzzy Hash: 29916bb825c6b9261617d56a75ee913fda9bd90a4ab4b82d9902a9746e2aaf95
Instruction Fuzzy Hash: 70E01A76B15315AB8B10DA98EE458DEB3F9EFD8121F100256E905A3300DA65BC018AE1

Uniqueness

Uniqueness Score: -1.00%

Function 05900D9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900DB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900DA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900DAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900DCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900D67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900C4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900C77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900C7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900C6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900BD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900BDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900BC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900BCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B07 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900F5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900B6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900E9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900E87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900EB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900AB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900ABF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900EDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900ADF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900AC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900ACF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900AE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900E0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900E3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 05900E77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1204864895.0000000005900000.00000010.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5900000_SetupPoker.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction ID: 517eddec2017aa7ff72992fd0c86d1d4cfdd412c0277d623a50b3b9449ef39a1
Opcode Fuzzy Hash: f7e87afd08902ea794ccc2ecb1d6b70ea1b724207e936763d02975072972c092
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SetupPoker.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\index[1].7z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\new[1].7z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\index[1].7z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\new[1].7z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\index[1].7z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\new[1].7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\WebInstaller_7012.log

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\index.html

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (1).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (10).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (11).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (12).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (13).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (14).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (15).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (16).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (17).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (18).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (19).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (2).7z

C:\Users\user\AppData\Local\Temp\WebInstaller_C49FBE6B451748A5B36D1C32CC29DCBB\new (20).7z

Windows Analysis Report
SetupPoker.exe