Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X

Overview

General Information

Sample URL:	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X
Analysis ID:	1432327
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Misleading page title found

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish45

Phishing site detected (based on logo match)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

HTTP GET or POST without a user agent

Invalid T&C link found

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 6100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,14208868564962595604,3052524558064138358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_45	Yara detected HtmlPhish_45	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://onetw.wanglinfeng.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://onetw.wanglinfeng.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	Avira URL Cloud: Label: phishing
Source: https://onetw.wanglinfeng.com/minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	Avira URL Cloud: Label: phishing
Source: https://onetw.wanglinfeng.com/minetake/images/key.svg	Avira URL Cloud: Label: phishing
Source: https://onetw.wanglinfeng.com/minetake/images/bg.jpg	Avira URL Cloud: Label: phishing

Phishing

Misleading page title found

Source: https://onetw.wanglinfeng.com/minetake/	Page Title: Microsoft \| Login
Source: https://onetw.wanglinfeng.com/minetake/	Page Title: Microsoft \| Login

Phishing site detected (based on favicon image match)

Source: https://wanglinfeng.com

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish45

Source: Yara match

File source: 1.2.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://onetw.wanglinfeng.com/minetake/

Matcher: Template: microsoft matched

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: Number of links: 0

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: Title: Microsoft | Login does not match URL

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: Invalid link: Privacy statement

Source: Chrome DOM: 0.1

ML Model on OCR Text: Matched 98.2% probability on "1 OneDrive You've received a secured doc via OneDrive, click on the view pdf button below to view the document online. PDF P.D. (12.01 MB) View Document "

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Downloads/ProjectUpdate-X.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/ProjectUpdate-X.pdf	HTTP Parser: No favicon
Source: https://onetw.wanglinfeng.com/minetake/	HTTP Parser: No favicon

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: No <meta name="author".. found

Source: https://onetw.wanglinfeng.com/minetake/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.13:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.141:443 -> 192.168.2.17:49744 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	HTTP traffic detected: GET /doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X HTTP/1.1Host: open.camscanner.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ORsMknvcz1PKnFR&MD=28FNTYEb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /minetake/ HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onetw.wanglinfeng.com/minetake/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://onetw.wanglinfeng.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetw.wanglinfeng.com/minetake/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onetw.wanglinfeng.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onetw.wanglinfeng.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onetw.wanglinfeng.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/key.svg HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetw.wanglinfeng.com/minetake/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/bg.jpg HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetw.wanglinfeng.com/minetake/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/key.svg HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /minetake/images/bg.jpg HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: onetw.wanglinfeng.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onetw.wanglinfeng.com/minetake/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ORsMknvcz1PKnFR&MD=28FNTYEb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDgAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAa6NsFTHCx%2B0lXq2gX96BskxGBoRUAfbDg3RpSwgDvA3/zVlAGmY3lwAp0%2B9CEF1xo1rWNe8wKFDQeprNYilCg5WUwRRhO6yy3qeh13Xg/c1kqvThhTjvGOKN39BZkTZwJ9cmUc8k%2BUUwDy2qHFCMhgYldO96lnrOYt96KP5rnq2kES5dKTMz5ogTfrRlWR5Ry9ZmF0Of%2Ba75SzOuFsVl6az2oAaX5X1WAIl0HAxl16jEJlQDsnbEmXpiw%2BEhrnPbZpkJPhRB4kt65TlpbSFLfHnMMIrap3rkCr/Y%2Brhs8hYdyPHGQvdpt5MHYZlBHLx2L60nGxBs37pDSUSP7A7ICcDZgAACGU9KW%2BOZysssAGBPGp4TJtTZQu/Sd3cbolgX%2Bm%2B9Ju0r3y%2BfX%2BtCA0ELA%2Bs%2Bz/jFW08APVraBLvRsWeJEKZoVZktgHjb1XUIj3xZsfURXdtMY%2BJFp9XBEj2x/U9tNReJyRWnt2zdJmiYk0xB2frK/GYv4%2BNiqnr3hx5tTfdc87iiahVL7dLAlxD4QBXiD/q3aumPn6Gok0wIxpR2G6qj67Hu0jMP7FbTryiPrmWD0WRhq9cmezhfG5i9yAIPggtdNvBjFk0NsAEHqqvvv6ZvgycQwtH6lEB5U7P41Ke6LsU5sujdwDJHwb4drYJeQVSp0RshrgOoQWEuf2bUybbqIQl442QcKprzLwzQGIggNX5i/Gie6mfA8s/gPs9mc2NFLZ3RgFs9oqDGfAj5WnQicEEPtGpR14JWEGtuZHWZd3ud/0yH1zG/3eAVGFHUjBi8pzVZ4jF3Uyy9x2A6R9DAHwDnDljPvoTC1Xgl9hUX8TckeNQMDGlNY6Q5p7z%2BlHLq%2BW/yQKg4YRDdu/wBFLJooD23V03WjHw9fFn9VpLQyseBpjI9wXKe/ngL9S3UZsEHcF%2BjIT/EmvDImXbAQ%3D%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1714159436User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 0FEDE8C12CB640A9AE5E8FFEDDD74431X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B

Source: global traffic	DNS traffic detected: DNS query: open.camscanner.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: onetw.wanglinfeng.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 441Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 19:23:15 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 87a8f23a7e75a51b-MIAalt-svc: h3=":443"; ma=86400

Source: chromecache_86.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_81.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: chromecache_81.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: chromecache_81.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: chromecache_89.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_89.1.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_81.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Archivo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6o3ms.woff2
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.wo
Source: chromecache_80.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.wo
Source: chromecache_79.1.dr, chromecache_82.1.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_79.1.dr, chromecache_82.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_82.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_81.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_81.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: chromecache_81.1.dr	String found in binary or memory: https://use.fontawesome.com/releases/v5.7.0/css/all.css
Source: chromecache_81.1.dr	String found in binary or memory: https://www.google.com
Source: 76dcb663-2e81-461e-9b72-8fb10e7d180f.tmp.0.dr, ProjectUpdate-X.pdf.crdownload.0.dr, chromecache_90.1.dr, bb9b9f8a-3667-4c1c-a153-54141f8fc828.tmp.0.dr	String found in binary or memory: https://www.pdfescape.com
Source: 76dcb663-2e81-461e-9b72-8fb10e7d180f.tmp.0.dr, ProjectUpdate-X.pdf.crdownload.0.dr, chromecache_90.1.dr, bb9b9f8a-3667-4c1c-a153-54141f8fc828.tmp.0.dr	String found in binary or memory: https://www.radpdf.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.13:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.141:443 -> 192.168.2.17:49744 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@22/43@18/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,14208868564962595604,3052524558064138358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,14208868564962595604,3052524558064138358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 90
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 90			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://getbootstrap.com)	0%	Avira URL Cloud	safe
https://onetw.wanglinfeng.com/favicon.ico	100%	Avira URL Cloud	phishing
file:///C:/Users/user/Downloads/ProjectUpdate-X.pdf	0%	Avira URL Cloud	safe
https://onetw.wanglinfeng.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	100%	Avira URL Cloud	phishing
https://onetw.wanglinfeng.com/minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	100%	Avira URL Cloud	phishing
https://onetw.wanglinfeng.com/minetake/images/key.svg	100%	Avira URL Cloud	phishing
https://onetw.wanglinfeng.com/minetake/images/bg.jpg	100%	Avira URL Cloud	phishing
https://www.radpdf.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false		high
onetw.wanglinfeng.com	104.21.89.211	true	false		unknown
code.jquery.com	151.101.66.137	true	false		high
cdnjs.cloudflare.com	104.17.24.14	true	false		high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false		high
www.google.com	142.250.217.228	true	false		high
brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com	54.94.125.253	true	false		high
open.camscanner.com	unknown	unknown	false		high
use.fontawesome.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onetw.wanglinfeng.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://onetw.wanglinfeng.com/minetake/	true		unknown
https://onetw.wanglinfeng.com/minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: phishing	unknown
https://onetw.wanglinfeng.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false	Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
file:///C:/Users/user/Downloads/ProjectUpdate-X.pdf	false	Avira URL Cloud: safe	low
https://onetw.wanglinfeng.com/minetake/images/bg.jpg	false	Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css	false		high
https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	false		high
https://onetw.wanglinfeng.com/minetake/images/key.svg	false	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fontawesome.com	chromecache_89.1.dr	false		high
https://www.google.com	chromecache_81.1.dr	false		high
https://www.pdfescape.com	76dcb663-2e81-461e-9b72-8fb10e7d180f.tmp.0.dr, ProjectUpdate-X.pdf.crdownload.0.dr, chromecache_90.1.dr, bb9b9f8a-3667-4c1c-a153-54141f8fc828.tmp.0.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_82.1.dr	false		high
https://getbootstrap.com)	chromecache_79.1.dr, chromecache_82.1.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_79.1.dr, chromecache_82.1.dr	false		high
https://use.fontawesome.com/releases/v5.7.0/css/all.css	chromecache_81.1.dr	false		high
http://opensource.org/licenses/MIT).	chromecache_86.1.dr	false		high
https://www.radpdf.com	76dcb663-2e81-461e-9b72-8fb10e7d180f.tmp.0.dr, ProjectUpdate-X.pdf.crdownload.0.dr, chromecache_90.1.dr, bb9b9f8a-3667-4c1c-a153-54141f8fc828.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com/license/free	chromecache_89.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States		13335	CLOUDFLARENETUS	false
142.250.217.228	www.google.com	United States		15169	GOOGLEUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States		13335	CLOUDFLARENETUS	false
104.21.89.211	onetw.wanglinfeng.com	United States		13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
151.101.66.137	code.jquery.com	United States		54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States		15169	GOOGLEUS	false
54.94.125.253	brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com	United States		16509	AMAZON-02US	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432327
Start date and time:	2024-04-26 21:22:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@22/43@18/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.50.67, 142.250.217.174, 108.177.12.84, 34.104.35.123, 23.45.182.79, 192.229.211.108, 142.250.64.202, 104.21.27.152, 172.67.142.245, 172.217.3.67, 142.250.189.138, 142.250.217.234, 192.178.50.74, 172.217.165.202, 172.217.15.202, 142.250.217.202, 192.178.50.42, 172.217.3.74, 172.217.2.202, 142.250.217.170, 142.250.217.195, 142.250.189.142
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ajax.googleapis.com, clientservices.googleapis.com, ctldl.windowsupdate.com, use.fontawesome.com.cdn.cloudflare.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, evoke-windowsservices-tas.msedge.net, update.googleapis.com, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 18:22:54 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9956626544791765
Encrypted:	false
SSDEEP:	48:83ddxjTy7fhEH7idAKZdA1JehwiZUklqehr1ny+3:83h4hAS5y
MD5:	F60B13EA3782C7844160282D9A05F6C3
SHA1:	7F38DAD9CEE31492EC6448A272E576730CC18DF9
SHA-256:	F30BAE8F2F64EADD9C9BBEA33B5B68AE2D52E7221364E2390D98E8853C266029
SHA-512:	DF85558AE14201AB7DC2A911C472A7DCC6617E7C9AAC62517F06A82FFD467A6B90359C4248AAC4AE0A7EB7E9B5C28F9D9F8D93BA26739375D20ECF654915E2D3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....!m.#........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 18:22:53 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0117811004666795
Encrypted:	false
SSDEEP:	48:8gddxjTy7fhEH7idAKZdA10eh/iZUkAQkqehC1ny+2:8gh4hK9Ql5y
MD5:	6F183B9594A5578A769AAC4E3AB8287C
SHA1:	603A05401D5494B22917F13D4C4038818ECB3729
SHA-256:	8D5C439DDC20407137496C7BD7D93BE59338B664CA92DF2179E2A573A31DECF4
SHA-512:	3E57D2AB65B26AE90A90370417D708B352B2A82137689E2514CF10255E91451564E2172669EC27D0D11DE78B860E2EF6B66CDC1608E6E7CF24519123609DA127
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......."........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.019299422311384
Encrypted:	false
SSDEEP:	48:8eddxjTy7fjH7idAKZdA14tIeh7sFiZUkmgqeh7sc1ny+BX:8eh4nnW5y
MD5:	DBE4DD9CC86779AB8E10A4EF3E6796E8
SHA1:	296C6B8D3851CD6CB5E30FBB762AAC9BCBDA52A0
SHA-256:	4017ADD67E69EC644776FC213E1E8EF7701FB8E9F8AF0B9E547714EDA7582692
SHA-512:	C2D55331E05650734970E7F1C51CE609CF0ECAD20C04A476B2E39D2183EA6B2E81336DDC5C289C5D2C849203A8D136EE8F3016E866C323053DB34BF627D9A282
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 18:22:53 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.009563798869131
Encrypted:	false
SSDEEP:	48:8/ddxjTy7fhEH7idAKZdA1behDiZUkwqeh+1ny+R:8/h4hhE5y
MD5:	7DCDEF1C6546AB10C03A3113040FB6D8
SHA1:	EA3698E21FB319010E8F0E6642C8354A15322F35
SHA-256:	9C873F5D7C48CCBF62F82CBE56FD78AE655D47810B9D4B530518A4705244C7C3
SHA-512:	96FB56DD449285D0EAEC7DF6BF7D9AE2AD86FE1C318BC69A682654A758DE22D39677106CFD44F2E7E7862F303E30215B5BD31235185DF0E9FF7D40174B3C6683
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......."........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 18:22:54 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.99700171327684
Encrypted:	false
SSDEEP:	48:80ddxjTy7fhEH7idAKZdA1VehBiZUk1W1qehw1ny+C:80h4hh9Q5y
MD5:	2664D3C25F676C71854BF69E7701C5B0
SHA1:	B54550D9470580C28A9040114F4DEA3E44EB1D39
SHA-256:	8C380CB7BAB71695FC504E4C7DAEF17B31184CD315E855443352D24937C58469
SHA-512:	130CDE6D56C44CE32E04D73591D027C8F41BA03A4801FFD91BF313B5A456668E895524EB56B49C490B4B05A39F3F23B4CACE004E0E0350B441AF7D817A4259EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....y.#........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 18:22:53 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.0107137811256415
Encrypted:	false
SSDEEP:	48:8cddxjTy7fhEH7idAKZdA1duT6ehOuTbbiZUk5OjqehOuTbW1ny+yT+:8ch4hxTTTbxWOvTbW5y7T
MD5:	77291E29E5CE16505CB146DB73775BE6
SHA1:	6DD4503921B791015C0AAD5C3A4558882FDD3CD6
SHA-256:	B46A382A4532B2A7F2940E001DEDCD888EFE434F8BA3D28E2D15488E3F718861
SHA-512:	4FA15875D451A2E167C1491A43105940A3CF58E64BBEBC934CB2FBA21EB8EBB9E536B4F595BB54ED95F5839F6D2CC6E89FEA4AC483C451024FEFB0F3FB47D271
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....K."........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........ZK.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\76dcb663-2e81-461e-9b72-8fb10e7d180f.tmp

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6
Category:	dropped
Size (bytes):	11682
Entropy (8bit):	7.003677997378957
Encrypted:	false
SSDEEP:	192:UtkIFkPdeJJWf9YE2Z95s0Y/JUwfotT2iDcpojmw9cD6Zg:UOL18JWdKkBen4Om0cD6G
MD5:	145DE6E478ADC7D5D4D00D4F4D51DAF2
SHA1:	77129B9C27E2211342816689139E6393CD76C21F
SHA-256:	8D153FDEE5E35CA594B47DA35B5171493FA05D3F5C58A23D0D33E84EEC464EC6
SHA-512:	FE68ADB7BFACAD8D0C67F17FA71878CE5D0D16369655C83CC4F5C026C7A784D228D382A0ADD62D2A8DF8DD2A7EA2EBF93386D2A2F656786EA48DE78973EA532F
Malicious:	false
Reputation:	low
Preview:	%PDF-1.6.%.....2 0 obj.<</Length 3470/Subtype/XML/Type/Metadata>>stream.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <pdf:Producer>RAD PDF 3.19.2.2 - https://www.radpdf.com</pdf:Producer>. <xmp:CreateDate>2018-11-06T10:46:01-11:00</xmp:CreateDate>. <xmp:CreatorTool>PDFescape Online - https://www.pdfescape.com</xmp:CreatorTool>. <xmp:MetadataDate>2024-04-25T15:48:20+01:00</xmp:MetadataDate>. <xmp:ModifyDate>2024-04-25T15:48:20+01:00</xmp:ModifyDate>. <dc:format>application/pdf</dc:format>. <dc

C:\Users\user\Downloads\ProjectUpdate-X.pdf (copy)

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6
Category:	dropped
Size (bytes):	135816
Entropy (8bit):	7.963826856222808
Encrypted:	false
SSDEEP:	3072:b8XgA0udg+WHVkLn8L3fzS2SoM406rQwgxeoe9SOrwn:oKTVkEzS2VSwye96n
MD5:	8C5645D2944C4B262E3B5813D266F0D5
SHA1:	57123765E8CAA2E6E6E5926DD95ABAFEBDC07E2D
SHA-256:	31A6B7AAA85A22D2CC39D2364E795B6552164C12006D948D6FC0B4CE6E340907
SHA-512:	4C6646816BC3F365CA9D6782D6E910B7158C2EBFA039B94CA26E422DEAFA10D500080E85499646C441DD417CC41A5AA9BBED715B69C40633389125DAC30DA421
Malicious:	false
Reputation:	low
Preview:	%PDF-1.6.%.....2 0 obj.<</Length 3470/Subtype/XML/Type/Metadata>>stream.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <pdf:Producer>RAD PDF 3.19.2.2 - https://www.radpdf.com</pdf:Producer>. <xmp:CreateDate>2018-11-06T10:46:01-11:00</xmp:CreateDate>. <xmp:CreatorTool>PDFescape Online - https://www.pdfescape.com</xmp:CreatorTool>. <xmp:MetadataDate>2024-04-25T15:48:20+01:00</xmp:MetadataDate>. <xmp:ModifyDate>2024-04-25T15:48:20+01:00</xmp:ModifyDate>. <dc:format>application/pdf</dc:format>. <dc

C:\Users\user\Downloads\ProjectUpdate-X.pdf.crdownload

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6
Category:	dropped
Size (bytes):	135816
Entropy (8bit):	7.963826856222808
Encrypted:	false
SSDEEP:	3072:b8XgA0udg+WHVkLn8L3fzS2SoM406rQwgxeoe9SOrwn:oKTVkEzS2VSwye96n
MD5:	8C5645D2944C4B262E3B5813D266F0D5
SHA1:	57123765E8CAA2E6E6E5926DD95ABAFEBDC07E2D
SHA-256:	31A6B7AAA85A22D2CC39D2364E795B6552164C12006D948D6FC0B4CE6E340907
SHA-512:	4C6646816BC3F365CA9D6782D6E910B7158C2EBFA039B94CA26E422DEAFA10D500080E85499646C441DD417CC41A5AA9BBED715B69C40633389125DAC30DA421
Malicious:	false
Reputation:	low
Preview:	%PDF-1.6.%.....2 0 obj.<</Length 3470/Subtype/XML/Type/Metadata>>stream.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <pdf:Producer>RAD PDF 3.19.2.2 - https://www.radpdf.com</pdf:Producer>. <xmp:CreateDate>2018-11-06T10:46:01-11:00</xmp:CreateDate>. <xmp:CreatorTool>PDFescape Online - https://www.pdfescape.com</xmp:CreatorTool>. <xmp:MetadataDate>2024-04-25T15:48:20+01:00</xmp:MetadataDate>. <xmp:ModifyDate>2024-04-25T15:48:20+01:00</xmp:ModifyDate>. <dc:format>application/pdf</dc:format>. <dc

C:\Users\user\Downloads\bb9b9f8a-3667-4c1c-a153-54141f8fc828.tmp

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6
Category:	dropped
Size (bytes):	135816
Entropy (8bit):	7.963826856222808
Encrypted:	false
SSDEEP:	3072:b8XgA0udg+WHVkLn8L3fzS2SoM406rQwgxeoe9SOrwn:oKTVkEzS2VSwye96n
MD5:	8C5645D2944C4B262E3B5813D266F0D5
SHA1:	57123765E8CAA2E6E6E5926DD95ABAFEBDC07E2D
SHA-256:	31A6B7AAA85A22D2CC39D2364E795B6552164C12006D948D6FC0B4CE6E340907
SHA-512:	4C6646816BC3F365CA9D6782D6E910B7158C2EBFA039B94CA26E422DEAFA10D500080E85499646C441DD417CC41A5AA9BBED715B69C40633389125DAC30DA421
Malicious:	false
Reputation:	low
Preview:	%PDF-1.6.%.....2 0 obj.<</Length 3470/Subtype/XML/Type/Metadata>>stream.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <pdf:Producer>RAD PDF 3.19.2.2 - https://www.radpdf.com</pdf:Producer>. <xmp:CreateDate>2018-11-06T10:46:01-11:00</xmp:CreateDate>. <xmp:CreatorTool>PDFescape Online - https://www.pdfescape.com</xmp:CreatorTool>. <xmp:MetadataDate>2024-04-25T15:48:20+01:00</xmp:MetadataDate>. <xmp:ModifyDate>2024-04-25T15:48:20+01:00</xmp:ModifyDate>. <dc:format>application/pdf</dc:format>. <dc

Chrome Cache Entry: 79

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65325)
Category:	downloaded
Size (bytes):	144877
Entropy (8bit):	5.049937202697915
Encrypted:	false
SSDEEP:	1536:GcoqwrUPyDHU7c7TcDEBi82NcuSELL4d/+oENM6HN26Q:VoPgPard2oENM6HN26Q
MD5:	450FC463B8B1A349DF717056FBB3E078
SHA1:	895125A4522A3B10EE7ADA06EE6503587CBF95C5
SHA-256:	2C0F3DCFE93D7E380C290FE4AB838ED8CADFF1596D62697F5444BE460D1F876D
SHA-512:	93BF1ED5F6D8B34F53413A86EFD4A925D578C97ABC757EA871F3F46F340745E4126C48219D2E8040713605B64A9ECF7AD986AA8102F5EA5ECF9228801D962F5D
Malicious:	false
Reputation:	low
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors. * Copyright 2011-2018 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace},::after,::before{box-sizing:border-box}html{font-family:sans

Chrome Cache Entry: 80

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1293
Entropy (8bit):	5.448893852817212
Encrypted:	false
SSDEEP:	24:81/nQOY7a4gwAZzhnQOY7a4goRVc+u/rnQOY7a4gHwy96DGSSf7:coOEa4gvGOEa4goRVc+uUOEa4gHN0oD
MD5:	CBA4ED6C809962AC6C2A26842183B67A
SHA1:	3F8E077AFC8EF5BAB7FA626EA782DAE34D419BBE
SHA-256:	AAE65C231008861C6430EBE296C926E728C4D2CCB1492F86E42D760E9B67D9A5
SHA-512:	84894B90DDA3CA3487F3E4F87F8244C78BA726331AC3EA290F6BD64830B0A21856A42333CC4EDBBF23DC2F063C53AD71B3F41864275D874AEBD37C198AE1CBE0
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
Preview:	/* vietnamese /.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rHmsJCQ.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext /.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/archivonarrow/v30/tss5ApVBdCYD5Q7hcxTE1ArZ0Zz8oY2KRmwvKhhvLFG6rXmsJCQ.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin */.@font-face {. font-family: 'Archivo Narrow';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com

Chrome Cache Entry: 81

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (52023), with CRLF line terminators
Category:	downloaded
Size (bytes):	887396
Entropy (8bit):	4.959935977371823
Encrypted:	false
SSDEEP:	24576:gxbrELGrged+G8C2YEVRyHdeKYCIT1Odhv3ZRA:+EL+gG8C2JiYCITWfA
MD5:	80961D901696638741EACDB3B5F3D520
SHA1:	844500AB6C9493C92D2156215DA39324B2A8471A
SHA-256:	03E5F344AA37D4E53CE9CCF76877DC16CDBCF86F1509A2A4790F120C0AD04D8B
SHA-512:	E42BFDE9382898281AAAE3A9917BF95A0E012DEB79615BD815BEBE2A582D58DE64CB15EAE9C99B72B3D6CDDE5D6472FB1438A496C18F701D77384640C395CA86
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/minetake/
Preview:	<!doctype html>..<html lang="en">....<head>.. <meta charset="utf-8">.. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.. <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css">.. <link href="https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap" rel="stylesheet">.. <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.7.0/css/all.css">.. <title>Microsoft \| Login</title>.. <style type="text/css">.. textarea:hover,.. input:hover,.. textarea:active,.. input:active,.. textarea:focus,.. input:focus,.. button:focus,.. button:active,.. button:hover,.. label:focus,.. .btn:active,.. .btn.active {.. outline: 0px !important;.. -webkit-appearance: none;.. box-shadow: none !important;.. }.... .box {.. box-shadow: 0 2px 6px rgb(0 0 0 / 20%);.. /border: 1px solid rgba(0, 0, 0, 0.4);/..

Chrome Cache Entry: 82

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	low
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 83

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/minetake/images/bg.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 84

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 85

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 86

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 87

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1238)
Category:	downloaded
Size (bytes):	1239
Entropy (8bit):	5.068464054671174
Encrypted:	false
SSDEEP:	24:ch63Cf5W8QPIHRZ3hwVFS39bYGwNef1yTZsNUkQ1sZmSuLqNWRco5Jcn5IKM6cuY:C6SQnw/x+SR8ZZkQbp1RZ5JwiKMm7Zc
MD5:	9E8F56E8E1806253BA01A95CFC3D392C
SHA1:	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728
SHA-256:	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
SHA-512:	63F0F6F94FBABADC3F774CCAA6A401696E8A7651A074BC077D214F91DA080B36714FD799EB40FED64154972008E34FC733D6EE314AC675727B37B58FFBEBEBEE
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Preview:	!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href")\|\|""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r

Chrome Cache Entry: 88

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 89

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54456)
Category:	downloaded
Size (bytes):	54641
Entropy (8bit):	4.712564291864468
Encrypted:	false
SSDEEP:	768:SuV31Uz1RPq4NvvU63HJYkQCZ/WMQyjJKp7CzsGnQzU:SuczrC4NnzHSBCkgu7cs1w
MD5:	251D28BD755F5269A4531DF8A81D5664
SHA1:	C0F035B41B23C6E8FAB735F618AA3CFF0897B4F9
SHA-256:	AFDC6BF2DE981FFD7D370B76F44E7580572F197EFBE214B9CFA4005D189D8EAE
SHA-512:	8111F411C21C6011644139DBA4EF24D1696C0F6D31E55CE384E0353A0F3E65402170C502BDDF803C3DF9149C371B31C03F77BE98FDBC61C0C9C55AFBE399681F
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.7.0/css/all.css
Preview:	/!. Font Awesome Free 5.7.0 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pull-lef

Chrome Cache Entry: 90

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.6
Category:	downloaded
Size (bytes):	135816
Entropy (8bit):	7.963826856222808
Encrypted:	false
SSDEEP:	3072:b8XgA0udg+WHVkLn8L3fzS2SoM406rQwgxeoe9SOrwn:oKTVkEzS2VSwye96n
MD5:	8C5645D2944C4B262E3B5813D266F0D5
SHA1:	57123765E8CAA2E6E6E5926DD95ABAFEBDC07E2D
SHA-256:	31A6B7AAA85A22D2CC39D2364E795B6552164C12006D948D6FC0B4CE6E340907
SHA-512:	4C6646816BC3F365CA9D6782D6E910B7158C2EBFA039B94CA26E422DEAFA10D500080E85499646C441DD417CC41A5AA9BBED715B69C40633389125DAC30DA421
Malicious:	false
Reputation:	low
URL:	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X
Preview:	%PDF-1.6.%.....2 0 obj.<</Length 3470/Subtype/XML/Type/Metadata>>stream.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:pdf="http://ns.adobe.com/pdf/1.3/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">. <pdf:Producer>RAD PDF 3.19.2.2 - https://www.radpdf.com</pdf:Producer>. <xmp:CreateDate>2018-11-06T10:46:01-11:00</xmp:CreateDate>. <xmp:CreatorTool>PDFescape Online - https://www.pdfescape.com</xmp:CreatorTool>. <xmp:MetadataDate>2024-04-25T15:48:20+01:00</xmp:MetadataDate>. <xmp:ModifyDate>2024-04-25T15:48:20+01:00</xmp:ModifyDate>. <dc:format>application/pdf</dc:format>. <dc

Chrome Cache Entry: 91

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.390319531114783
Encrypted:	false
SSDEEP:	3:HYmpBth0tYY:4mpbgYY
MD5:	EB3CE3190D8A58E048D35E620747D3A5
SHA1:	76B5B6461189F839B018EF5C785DB4836B818B7D
SHA-256:	2D670E2962D8D805B95912CACA0822CE7C6913636BA40373C6E6AEA73CAC8457
SHA-512:	08F9C680B09CC25919A91F8E080CFC517F7354F49759DDC8CF6FFEB5ADE2E46F80A866E7531B6EA97188A5E4647093350F91ED51254351C47BCE3488EF88A595
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAn8u6sHq_qkzRIFDa0JrrESEAlKZdmla1zP1hIFDUPzdjk=?alt=proto
Preview:	CgkKBw2tCa6xGgAKCQoHDUPzdjkaAA==

Chrome Cache Entry: 92

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/minetake/images/key.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 93

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 94

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Reputation:	low
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 95

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	315
Entropy (8bit):	5.0572271090563765
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
MD5:	A34AC19F4AFAE63ADC5D2F7BC970C07F
SHA1:	A82190FC530C265AA40A045C21770D967F4767B8
SHA-256:	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
SHA-512:	42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
Malicious:	false
Reputation:	low
URL:	https://onetw.wanglinfeng.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.

Chrome Cache Entry: 96

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Reputation:	low
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 21:22:52.877075911 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.877131939 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:52.877217054 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.877734900 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.877757072 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:52.878452063 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.878477097 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:52.878556967 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.878731966 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:52.878756046 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.800913095 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.801186085 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.801220894 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.802197933 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.802273989 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.803611994 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.803675890 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.803776026 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.803792000 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.815188885 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.815387964 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.815412998 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.816329956 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.816395998 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.816623926 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.816679955 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.849395990 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.865298986 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:53.865319014 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:53.920267105 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.017553091 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.017586946 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.017708063 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.017765045 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.017836094 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.247884989 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.247993946 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.248267889 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.248306036 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.248318911 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.475846052 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.476067066 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.476310015 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.476378918 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.476619959 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.476684093 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.476766109 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.476824999 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.476950884 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.477008104 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.704566956 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.704660892 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.704785109 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.704847097 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.704919100 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.704993010 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.705518961 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.705599070 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.706199884 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.706305027 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.706665993 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.706737041 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.707120895 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.707191944 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.707628965 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.707695961 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.708439112 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.708503008 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.709580898 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.709655046 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.933454037 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.933464050 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.933510065 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.933557987 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.933608055 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.933648109 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.933876038 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.933939934 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.933954954 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.934020042 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.934472084 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.934550047 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.934926987 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.934995890 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.935336113 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.935401917 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.935702085 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.935765028 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.936197996 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.936273098 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.936528921 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.936598063 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.936880112 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.936942101 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.937381029 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.937458992 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.937836885 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.937905073 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.938368082 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.938433886 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.938775063 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.938853979 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.939445972 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.939508915 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.939616919 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.939676046 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.939728022 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.939846039 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.939846039 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:55.939877987 CEST	443	49701	54.94.125.253	192.168.2.17
Apr 26, 2024 21:22:55.939955950 CEST	49701	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:22:56.360305071 CEST	49677	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:22:56.360342026 CEST	49678	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:22:56.360351086 CEST	49676	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:22:57.955894947 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:57.955991030 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:57.956079006 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.011981010 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.012022972 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.404140949 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.404532909 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.404560089 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.405405998 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.405483961 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.406491995 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.406555891 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.458307981 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:22:58.458336115 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:22:58.506294012 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:05.007069111 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:05.319406986 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:05.922935963 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:06.701663017 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:06.701703072 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:06.701801062 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:06.704090118 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:06.704108953 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.133352995 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:07.230951071 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.231049061 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.235213041 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.235223055 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.235439062 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.275373936 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.276154995 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.276240110 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.276355982 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.277308941 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.277344942 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.297317028 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.344124079 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.538764000 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.538897038 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.542467117 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.542484999 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.542959929 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.584636927 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.628118992 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.733346939 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733382940 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733392000 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733411074 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733453989 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733503103 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.733530045 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733565092 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.733597994 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.733607054 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.733650923 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.746952057 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.746968985 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.747000933 CEST	49709	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:07.747005939 CEST	443	49709	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:07.779886961 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.780031919 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.780083895 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.780155897 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.780200958 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.780200958 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.780224085 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.780261040 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.820559978 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.820602894 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.820770025 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.821067095 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:07.821094990 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:07.948060036 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.073935986 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.075222969 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.075233936 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.075299978 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.076679945 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.076771021 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.076961040 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.077465057 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.077572107 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.083004951 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.083093882 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.084289074 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.084305048 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.085102081 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.086806059 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.128125906 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.212807894 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.212831974 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.212846994 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.213023901 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.213089943 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.213584900 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.213722944 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.341104031 CEST	443	49691	204.79.197.200	192.168.2.17
Apr 26, 2024 21:23:08.341195107 CEST	49691	443	192.168.2.17	204.79.197.200
Apr 26, 2024 21:23:08.345065117 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.345807076 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.345885038 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.346034050 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.346055031 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.346071005 CEST	49713	443	192.168.2.17	23.204.76.112
Apr 26, 2024 21:23:08.346077919 CEST	443	49713	23.204.76.112	192.168.2.17
Apr 26, 2024 21:23:08.386629105 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:08.386689901 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:08.386754990 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:08.800822020 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:09.021862030 CEST	49705	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:09.021892071 CEST	443	49705	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:09.115402937 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:09.544394970 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:09.719427109 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:10.918651104 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.918694973 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:10.918756962 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.918981075 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.918994904 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:10.919300079 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.919337988 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:10.919389009 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.919652939 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:10.919670105 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:10.926383018 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:11.183722973 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.184408903 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.184437990 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.185411930 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.185468912 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.187443972 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.189950943 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.189970016 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.193722963 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.193800926 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.209090948 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.209181070 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.209270000 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.209364891 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.209393024 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.209408045 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.261374950 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.262767076 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.262783051 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.309371948 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618098021 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618139982 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618170977 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618186951 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618211985 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618244886 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618256092 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618263006 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618303061 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618309975 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618629932 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618654013 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618676901 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618684053 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.618721962 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.618988037 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.673363924 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.673396111 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.679887056 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.679909945 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.679970026 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.679991007 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.680042982 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.680048943 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.680517912 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.680557966 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.680567980 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.680577040 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.680643082 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.680707932 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.681015968 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.681076050 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.681083918 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.681725025 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.681788921 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.681796074 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.681982994 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.682003975 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.682013988 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.682029009 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.682044983 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.682127953 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.682353020 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.682509899 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.682600975 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.682607889 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.683464050 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.683490038 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.683541059 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.683548927 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.683593035 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.684344053 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.684565067 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.684617043 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.684624910 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.685075045 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.685113907 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.685138941 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.685141087 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.685153008 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.685183048 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.728125095 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.737360001 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.742551088 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.742755890 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.742763042 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.742830038 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.742852926 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.743033886 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.743083000 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.743091106 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.743134022 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.743819952 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.743874073 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.743963003 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.744009018 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.744612932 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.744671106 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.761262894 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.761326075 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.761506081 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.761567116 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.784354925 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:11.784388065 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:11.784467936 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:11.784683943 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:11.784702063 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:11.818145037 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.818208933 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.824685097 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.824754000 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.824976921 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.825047970 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.825354099 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.825417995 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827765942 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827799082 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827819109 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827833891 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827843904 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827874899 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827881098 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827893972 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827900887 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827912092 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827922106 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827922106 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.827965975 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.827972889 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.828017950 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.828036070 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.828084946 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.829476118 CEST	49715	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.829490900 CEST	443	49715	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.867336988 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.867420912 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.868520021 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.868551970 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.868607998 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.868619919 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.868633032 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.868910074 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.868964911 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.868972063 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869004011 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869016886 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.869023085 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869035006 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869048119 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.869076014 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.869081020 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869796991 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869822979 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869860888 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.869869947 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.869904995 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.870245934 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.870302916 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.870311022 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.870356083 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.870764971 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.870815992 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.871222973 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.871259928 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.871270895 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.871277094 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.871299982 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.871315956 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.871320009 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.876257896 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.876310110 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.876318932 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.876362085 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.885540009 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.885595083 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.885756969 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.885817051 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.886018991 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.886069059 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.886743069 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.886804104 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.887499094 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.887562990 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.887826920 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.887882948 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.888303041 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.888370991 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.888377905 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.889127970 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.889180899 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.889189005 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.889226913 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.948277950 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.948299885 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.948381901 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.948416948 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.948652983 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.956033945 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.956074953 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.956095934 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.956108093 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.956146955 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.960521936 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960537910 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960604906 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960621119 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.960628986 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960643053 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960669041 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.960676908 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.960717916 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.962393999 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.962428093 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.962443113 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.962451935 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.962479115 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.962492943 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.963696003 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.963774920 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.964999914 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.965064049 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.967487097 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.967572927 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.970530987 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.970546007 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.970611095 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.970621109 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.970710993 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.973330975 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.973386049 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.973397970 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.973408937 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.973464012 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.973473072 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.973509073 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.975630045 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.975692034 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.979023933 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.979063034 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.979087114 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.979094982 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.979137897 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.979151964 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.993767023 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.993788004 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.993835926 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.993846893 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.993894100 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.994662046 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.994699001 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.994719982 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.994725943 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.994767904 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.997251034 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.997271061 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.997319937 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.997327089 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.997376919 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.999090910 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.999109030 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.999154091 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.999162912 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:11.999202013 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:11.999221087 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.001789093 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.001810074 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.001854897 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.001861095 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.001902103 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.001926899 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.003685951 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.003705025 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.003757000 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.003763914 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.003822088 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.006289959 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.006309032 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.006400108 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.006407022 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.006443977 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.011779070 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.011799097 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.011854887 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.011862040 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.011897087 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.014982939 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.015000105 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.015049934 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.015057087 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.015084028 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.015106916 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.017214060 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.017229080 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.017277956 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.017283916 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.017311096 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.017330885 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.021446943 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.021467924 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.021572113 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.021579027 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.021620989 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.025832891 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.025850058 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.025927067 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.025933981 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.025978088 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.071810961 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.072056055 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.072077036 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.072879076 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.072899103 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.072952986 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.072962999 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.072999001 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.073016882 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.073101997 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.073158026 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.074172974 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.074242115 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.074362993 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.074373960 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.080970049 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.080986977 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.081046104 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.081053972 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.081090927 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.083619118 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.083635092 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.083683014 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.083689928 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.083724022 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.083736897 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.085552931 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.085570097 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.085659981 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.085669994 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.085867882 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.087954044 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.087970972 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.088033915 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.088041067 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.088080883 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.089855909 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.089874029 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.089920044 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.089926958 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.089956999 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.089978933 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.092638969 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.092660904 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.092734098 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.092744112 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.092780113 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.095062017 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.095081091 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.095133066 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.095139027 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.095177889 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.095196009 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.096720934 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.096740961 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.096792936 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.096798897 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.096837997 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.099392891 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.099406958 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.099462032 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.099469900 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.099508047 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.101349115 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.101366043 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.101421118 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.101429939 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.101469994 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.104008913 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.104027033 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.104079008 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.104089975 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.104213953 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.105690002 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.105705976 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.105766058 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.105773926 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.106105089 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.116388083 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.117403030 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.117419958 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.117485046 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.117492914 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.117528915 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.118277073 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.118321896 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.118362904 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.118371010 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.118412018 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.118429899 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.120827913 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.120842934 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.120887995 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.120897055 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.120929956 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.122834921 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.122848988 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.122894049 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.122900963 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.122924089 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.122941017 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.125216007 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.125231981 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.125278950 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.125288010 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.125359058 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.127353907 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.127368927 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.127415895 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.127424955 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.127448082 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.127461910 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.129868031 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.129884958 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.129926920 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.129933119 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.129961014 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.129978895 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.131899118 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.131915092 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.131959915 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.131966114 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.131990910 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.132009983 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.134459972 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.134478092 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.134532928 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.134541035 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.134584904 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.137017965 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.137033939 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.137089014 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.137095928 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.137135029 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.145834923 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.145850897 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.145899057 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.145906925 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.145951986 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.145962000 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.155468941 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155493975 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155519962 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155551910 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.155561924 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155584097 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.155601978 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155761003 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.155769110 CEST	443	49714	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.155793905 CEST	49714	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.366508007 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366554022 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366585016 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366612911 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366620064 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.366641998 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366666079 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.366678953 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366699934 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366736889 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.366749048 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366787910 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.366926908 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.366975069 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367011070 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367021084 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.367029905 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367182016 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.367857933 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367922068 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367949963 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367974997 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.367985964 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.367996931 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.368021965 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.368838072 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.368868113 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.368886948 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.368899107 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369093895 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.369102955 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369666100 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369699001 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369728088 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369745016 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.369755030 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.369771957 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.370764017 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.370810986 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.370820999 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.370935917 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.370970964 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.370980024 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.371498108 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.371650934 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.371659994 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.371937990 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372010946 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.372021914 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372165918 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372203112 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.372214079 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372550011 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372608900 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.372620106 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372747898 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.372791052 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.372797966 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.373348951 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.373413086 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.373414040 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.373425961 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.373462915 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.374262094 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.374327898 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.491458893 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.491553068 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.491591930 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.491799116 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.491806030 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.491825104 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.491849899 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.492495060 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.492567062 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.492579937 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.492686033 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.492748976 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.492877960 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.493522882 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.493594885 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.494415045 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.494476080 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.494666100 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.494723082 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.495747089 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.495816946 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.496166945 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.496225119 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.496304989 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.496368885 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.497591972 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.497651100 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.498060942 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.498169899 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.498188972 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.498208046 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.498238087 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.498260975 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.498925924 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.498980045 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.499686003 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.499756098 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.499954939 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.500005960 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.545017958 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.545084000 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.559413910 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.559467077 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.559550047 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.560647011 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.560663939 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.615590096 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.615665913 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.616153955 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.616219997 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.616396904 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.616446972 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.616862059 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.616933107 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.616941929 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.616959095 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.616987944 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.617021084 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.617151976 CEST	49716	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.617157936 CEST	443	49716	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.620109081 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.620153904 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.620244980 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.621691942 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.621706009 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.687138081 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.687184095 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.687247038 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.687411070 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.687423944 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.746975899 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:12.747004986 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:12.747117043 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:12.747314930 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:12.747328997 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:12.818952084 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.819263935 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.819289923 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.819655895 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.819971085 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.820024967 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.820153952 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:12.864156961 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:12.877475977 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.877919912 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.877939939 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.878385067 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.878890038 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.878971100 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.879018068 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.924113989 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:12.928513050 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:12.954185963 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.954698086 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.954749107 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.958127022 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.958262920 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.959671021 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.959786892 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:12.959872007 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:12.959887028 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.008526087 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.030589104 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.030832052 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.030850887 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.031711102 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.031799078 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.032835007 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.032882929 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.033030987 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.033040047 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.087508917 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.146198034 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.146226883 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.146300077 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.146636009 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.146665096 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.148811102 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.148869991 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.148938894 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.149172068 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.149194002 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.177862883 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.177921057 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.177973986 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.177999973 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.178030014 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178073883 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178112030 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178127050 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.178134918 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178195953 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.178455114 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178539991 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178591013 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.178599119 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.178642988 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.178649902 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.179258108 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.179296017 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.179337025 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.179373026 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.179402113 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.179402113 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.179411888 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.180200100 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.180241108 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.180274963 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.180279016 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.180279016 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.180289984 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.180372000 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.181083918 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.181160927 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.181200027 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.181237936 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.181241035 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.181248903 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.181390047 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.182037115 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.182106018 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.182113886 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.182158947 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.182359934 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.182476997 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.182487011 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.182650089 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.182955980 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183191061 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183259010 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183300972 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.183310032 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183589935 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.183799028 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183890104 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183928013 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.183978081 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.183984995 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.184025049 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.184042931 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.184123993 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.184335947 CEST	49720	443	192.168.2.17	104.18.11.207
Apr 26, 2024 21:23:13.184353113 CEST	443	49720	104.18.11.207	192.168.2.17
Apr 26, 2024 21:23:13.245646954 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.245726109 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.245757103 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246001005 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246018887 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.246046066 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246062040 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.246268034 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246308088 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246392012 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.246401072 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246438026 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.246701002 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246797085 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.246850967 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.246857882 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247461081 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247503042 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247519970 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.247525930 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247562885 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.247569084 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247806072 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.247859955 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.248034954 CEST	49722	443	192.168.2.17	104.17.24.14
Apr 26, 2024 21:23:13.248049974 CEST	443	49722	104.17.24.14	192.168.2.17
Apr 26, 2024 21:23:13.291941881 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292026997 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292072058 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292171001 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292177916 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.292196989 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292232037 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292259932 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.292270899 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.292342901 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.293162107 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293184996 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293246984 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293272018 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.293282032 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293299913 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.293358088 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293390036 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293454885 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.293467045 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.294534922 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.295283079 CEST	49719	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.295301914 CEST	443	49719	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.309391022 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.309542894 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.309588909 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.309711933 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.309726954 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.313258886 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.316904068 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.326495886 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:13.329359055 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.329410076 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.329499960 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.329513073 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.329911947 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.344968081 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.352092028 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.352174044 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.352183104 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.353921890 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.354012966 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.354020119 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.355715990 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.355771065 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.355777979 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.356456041 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.356539965 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.356547117 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.356883049 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.357115030 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.357121944 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.357292891 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.357378960 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.357386112 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.358195066 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.358243942 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.358247042 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.358253002 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.358341932 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.358803034 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.360647917 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.360793114 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.360801935 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.406388998 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.406961918 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.407269001 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.407284975 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.407610893 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.408024073 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.408083916 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.408132076 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.409912109 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.410139084 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.410188913 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.410509109 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.410856009 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.410909891 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.410959959 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.446021080 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.448116064 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.448173046 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.448179007 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.452431917 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.452467918 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.452552080 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.452559948 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.452707052 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.454401970 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.454405069 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.454420090 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.454428911 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.456526995 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.460607052 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.460891962 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.460902929 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.461757898 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.461786032 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.461857080 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.462116003 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.462131023 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.464572906 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.464817047 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.464828014 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.468538046 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.468599081 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.468609095 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.472203016 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.473026037 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.473033905 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.481664896 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.483592033 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.483618975 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.483666897 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.483680010 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.483706951 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.497778893 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.497790098 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.497837067 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.497898102 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.497944117 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.498104095 CEST	49723	443	192.168.2.17	151.101.66.137
Apr 26, 2024 21:23:13.498115063 CEST	443	49723	151.101.66.137	192.168.2.17
Apr 26, 2024 21:23:13.721951008 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.773401976 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.849356890 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.849397898 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.849448919 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.849461079 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.849509001 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.851933956 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.851964951 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.851988077 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852008104 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852016926 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.852025032 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852086067 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852155924 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.852157116 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.852212906 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852293015 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852319956 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852349043 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.852366924 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.852415085 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.853085995 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.853153944 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.853183985 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.853199959 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.853214979 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.853265047 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:13.853272915 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:13.853315115 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.205826998 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.205852032 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.206917048 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.206985950 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.227705002 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.227780104 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.227935076 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.227950096 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.260265112 CEST	49725	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.260314941 CEST	443	49725	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.260550976 CEST	49726	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.260581017 CEST	443	49726	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.281382084 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.300981998 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.301065922 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.301157951 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.301400900 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.301443100 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.302580118 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.302624941 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.302684069 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.302926064 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.302943945 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.345472097 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:14.371119022 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371160984 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371191025 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371210098 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.371222019 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371251106 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371257067 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.371263981 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371290922 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371294975 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.371321917 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.371381998 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.373706102 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.373759031 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.373789072 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.373817921 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.373826981 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.373864889 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.374155045 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.374197006 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.374233007 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.374239922 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.374250889 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.374289036 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.374387026 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.374399900 CEST	443	49727	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.374408960 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.374439955 CEST	49727	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.406716108 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.406805992 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.406903028 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.407215118 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.407248974 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.560878992 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.563199997 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.563244104 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.563745975 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.564516068 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.565349102 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.565363884 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.565853119 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.567080975 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.567187071 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.569101095 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.569191933 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.570208073 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.570280075 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.616118908 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.616133928 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.670439959 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.671310902 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.671329975 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.671622992 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.673490047 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.673552036 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.673667908 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.716140985 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902529955 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902586937 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902637005 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902651072 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902667999 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902698040 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902719021 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902730942 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902761936 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902767897 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902791023 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902800083 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902842045 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902859926 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902868986 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902889967 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902924061 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902940035 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902947903 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.902968884 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.902990103 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903029919 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903032064 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.903040886 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903080940 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.903109074 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903208971 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.903218031 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903238058 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.903285027 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.903728962 CEST	49728	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.903743982 CEST	443	49728	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:14.904006958 CEST	49729	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:14.904028893 CEST	443	49729	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:15.230238914 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:15.230331898 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:15.230509996 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:15.232372999 CEST	49730	443	192.168.2.17	104.21.89.211
Apr 26, 2024 21:23:15.232414007 CEST	443	49730	104.21.89.211	192.168.2.17
Apr 26, 2024 21:23:15.357732058 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.357774973 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.357847929 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.358592033 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.358611107 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.686547995 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.686836958 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.686851025 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.687948942 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.688024998 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.689656019 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.689723015 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.689939976 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:15.689951897 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:15.732448101 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.041435957 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.041502953 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.041625977 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.041986942 CEST	49734	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.042011976 CEST	443	49734	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.042838097 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.042939901 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.043040037 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.043278933 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.043315887 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.367475986 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.367803097 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.367835999 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.368165016 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.368525982 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.368588924 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:16.368654013 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:16.412122011 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:17.183075905 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:17.183332920 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:17.183415890 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:17.244344950 CEST	49735	443	192.168.2.17	35.190.80.1
Apr 26, 2024 21:23:17.244374990 CEST	443	49735	35.190.80.1	192.168.2.17
Apr 26, 2024 21:23:18.136534929 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:23.967451096 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 21:23:27.739494085 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 21:23:38.870559931 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:23:38.870584965 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:23:42.751826048 CEST	49698	80	192.168.2.17	199.232.214.172
Apr 26, 2024 21:23:42.884351015 CEST	80	49698	199.232.214.172	192.168.2.17
Apr 26, 2024 21:23:42.884375095 CEST	80	49698	199.232.214.172	192.168.2.17
Apr 26, 2024 21:23:42.884546995 CEST	49698	80	192.168.2.17	199.232.214.172
Apr 26, 2024 21:23:44.151526928 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.151626110 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:44.151794910 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.152828932 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.152863979 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:44.677755117 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:44.678035021 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.679577112 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.679608107 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:44.679841042 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:44.681770086 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:44.724160910 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.190565109 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.190592051 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.190629959 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.190707922 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.190736055 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.190754890 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.190795898 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.192043066 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.192085028 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.192109108 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.192116976 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.192140102 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.192161083 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.192198038 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.193605900 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.193619967 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:45.193638086 CEST	49736	443	192.168.2.17	52.165.165.26
Apr 26, 2024 21:23:45.193645000 CEST	443	49736	52.165.165.26	192.168.2.17
Apr 26, 2024 21:23:55.021998882 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:23:55.022188902 CEST	443	49700	54.94.125.253	192.168.2.17
Apr 26, 2024 21:23:55.022367001 CEST	49700	443	192.168.2.17	54.94.125.253
Apr 26, 2024 21:23:57.642010927 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:57.642055988 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:57.642262936 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:57.642518997 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:57.642534971 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:58.019004107 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:58.019445896 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:58.019473076 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:58.019787073 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:58.020459890 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:58.020518064 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:23:58.077626944 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:23:58.294661999 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.294749975 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:58.294858932 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.295830965 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.295874119 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:58.585258007 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:58.585288048 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:58.585362911 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:58.616981983 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:58.617002964 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:58.791356087 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:58.791465998 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.827533007 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.827579021 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:58.828476906 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:58.829838991 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.829891920 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:58.829921961 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.007843018 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.007926941 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.011909962 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.011918068 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.012262106 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.050055027 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.096113920 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.200835943 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.200897932 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.200953960 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.200994968 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.201066017 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.201097012 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.201107979 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.201157093 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.201570988 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.201610088 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.201634884 CEST	49739	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.201651096 CEST	443	49739	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.202634096 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202685118 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202723026 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202761889 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.202775955 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202812910 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202820063 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.202827930 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.202864885 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.202871084 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.203113079 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.203171968 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.211410046 CEST	49740	443	192.168.2.17	13.107.5.88
Apr 26, 2024 21:23:59.211420059 CEST	443	49740	13.107.5.88	192.168.2.17
Apr 26, 2024 21:23:59.284849882 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.284893036 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.284976006 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.285128117 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.285135984 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.772811890 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.773322105 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.773364067 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.773946047 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.773953915 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:23:59.773993969 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:23:59.774029970 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.137902975 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.137964010 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.138025045 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.138032913 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.138075113 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.138111115 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.138197899 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.138299942 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.138439894 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.138459921 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.138472080 CEST	49741	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.138479948 CEST	443	49741	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.200939894 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.201004982 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.201098919 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.201248884 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.201265097 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.685606956 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.686234951 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.686279058 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.686979055 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.686980009 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:00.687000036 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:00.687036037 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.054672956 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.054728031 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.054800034 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.054850101 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.054884911 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.054910898 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.054927111 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.055063009 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.055280924 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.055282116 CEST	49742	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.055314064 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.055336952 CEST	443	49742	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.110697985 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.110776901 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.111160994 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.111160994 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.111234903 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.594217062 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.595722914 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.595722914 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.595799923 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.595835924 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.595870972 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.595890999 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957283974 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957343102 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957434893 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957473993 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.957509995 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957560062 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.957568884 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957710028 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.957861900 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.957895041 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:01.957921028 CEST	49743	443	192.168.2.17	40.126.28.13
Apr 26, 2024 21:24:01.957935095 CEST	443	49743	40.126.28.13	192.168.2.17
Apr 26, 2024 21:24:02.178920984 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.178993940 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.179096937 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.181030035 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.181065083 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.508171082 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.508282900 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.564336061 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.564385891 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.565385103 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.565464020 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.567058086 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.567115068 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.817389965 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.817533016 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.817696095 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.817740917 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.818130016 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:02.818167925 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.819312096 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.822766066 CEST	49744	443	192.168.2.17	23.219.0.141
Apr 26, 2024 21:24:02.822804928 CEST	443	49744	23.219.0.141	192.168.2.17
Apr 26, 2024 21:24:07.989166975 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:24:07.989228964 CEST	443	49738	142.250.217.228	192.168.2.17
Apr 26, 2024 21:24:07.989296913 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:24:09.021389008 CEST	49738	443	192.168.2.17	142.250.217.228
Apr 26, 2024 21:24:09.021415949 CEST	443	49738	142.250.217.228	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 21:22:52.748969078 CEST	64658	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:22:52.749129057 CEST	57360	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:22:52.863195896 CEST	53	61045	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:52.873850107 CEST	53	64658	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:52.876032114 CEST	53	57360	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:52.950422049 CEST	53	55274	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:53.905276060 CEST	53	59525	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:57.638247013 CEST	59503	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:22:57.678343058 CEST	49618	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:22:57.764045000 CEST	53	59503	1.1.1.1	192.168.2.17
Apr 26, 2024 21:22:57.804109097 CEST	53	49618	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:10.722126961 CEST	56675	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:10.722646952 CEST	52965	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:10.859281063 CEST	53	52965	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:10.917906046 CEST	53	56675	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:11.096349955 CEST	53	55404	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:11.641174078 CEST	65483	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:11.641613960 CEST	60762	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:11.644229889 CEST	54720	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:11.645035982 CEST	63585	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:11.783639908 CEST	53	65483	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:11.783735991 CEST	53	60762	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:11.788788080 CEST	53	62808	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.560276985 CEST	58918	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:12.560432911 CEST	56597	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:12.620846033 CEST	52008	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:12.620969057 CEST	63934	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:12.685363054 CEST	53	51753	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.686099052 CEST	53	56597	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.686525106 CEST	53	58918	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.746253967 CEST	53	63934	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.746386051 CEST	53	52008	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:12.748929977 CEST	53	52229	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:13.298934937 CEST	52909	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:13.298995972 CEST	57538	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:13.425539970 CEST	53	57538	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:13.461150885 CEST	53	52909	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:14.520849943 CEST	53	52847	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:15.232067108 CEST	62686	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:15.232235909 CEST	59113	53	192.168.2.17	1.1.1.1
Apr 26, 2024 21:23:15.356889009 CEST	53	59113	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:15.357023001 CEST	53	62686	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:30.214782000 CEST	53	53880	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:52.767596960 CEST	53	56839	1.1.1.1	192.168.2.17
Apr 26, 2024 21:23:52.865274906 CEST	53	63892	1.1.1.1	192.168.2.17
Apr 26, 2024 21:24:06.025907993 CEST	138	138	192.168.2.17	192.168.2.255
Apr 26, 2024 21:24:20.954056025 CEST	53	59437	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 21:22:52.748969078 CEST	192.168.2.17	1.1.1.1	0x44c6	Standard query (0)	open.camscanner.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:22:52.749129057 CEST	192.168.2.17	1.1.1.1	0xfaec	Standard query (0)	open.camscanner.com	65	IN (0x0001)	false
Apr 26, 2024 21:22:57.638247013 CEST	192.168.2.17	1.1.1.1	0x48e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:22:57.678343058 CEST	192.168.2.17	1.1.1.1	0x961c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:10.722126961 CEST	192.168.2.17	1.1.1.1	0x5df5	Standard query (0)	onetw.wanglinfeng.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:10.722646952 CEST	192.168.2.17	1.1.1.1	0x6289	Standard query (0)	onetw.wanglinfeng.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:11.641174078 CEST	192.168.2.17	1.1.1.1	0x28c5	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:11.641613960 CEST	192.168.2.17	1.1.1.1	0xfbee	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:11.644229889 CEST	192.168.2.17	1.1.1.1	0x8fda	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:11.645035982 CEST	192.168.2.17	1.1.1.1	0xb6a3	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:12.560276985 CEST	192.168.2.17	1.1.1.1	0x8e84	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.560432911 CEST	192.168.2.17	1.1.1.1	0x6fad	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:12.620846033 CEST	192.168.2.17	1.1.1.1	0xb784	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.620969057 CEST	192.168.2.17	1.1.1.1	0x5029	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:13.298934937 CEST	192.168.2.17	1.1.1.1	0xbe30	Standard query (0)	onetw.wanglinfeng.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:13.298995972 CEST	192.168.2.17	1.1.1.1	0x5530	Standard query (0)	onetw.wanglinfeng.com	65	IN (0x0001)	false
Apr 26, 2024 21:23:15.232067108 CEST	192.168.2.17	1.1.1.1	0x100b	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:15.232235909 CEST	192.168.2.17	1.1.1.1	0xecb7	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 21:22:52.873850107 CEST	1.1.1.1	192.168.2.17	0x44c6	No error (0)	open.camscanner.com	brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 21:22:52.873850107 CEST	1.1.1.1	192.168.2.17	0x44c6	No error (0)	brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com		54.94.125.253	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:22:52.873850107 CEST	1.1.1.1	192.168.2.17	0x44c6	No error (0)	brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com		18.230.159.161	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:22:52.876032114 CEST	1.1.1.1	192.168.2.17	0xfaec	No error (0)	open.camscanner.com	brazil-proxy-6dd3fa02e902f93c.elb.sa-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 21:22:57.764045000 CEST	1.1.1.1	192.168.2.17	0x48e6	No error (0)	www.google.com		142.250.217.228	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:22:57.804109097 CEST	1.1.1.1	192.168.2.17	0x961c	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 21:23:10.859281063 CEST	1.1.1.1	192.168.2.17	0x6289	No error (0)	onetw.wanglinfeng.com			65	IN (0x0001)	false
Apr 26, 2024 21:23:10.917906046 CEST	1.1.1.1	192.168.2.17	0x5df5	No error (0)	onetw.wanglinfeng.com		104.21.89.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:10.917906046 CEST	1.1.1.1	192.168.2.17	0x5df5	No error (0)	onetw.wanglinfeng.com		172.67.147.90	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:11.783639908 CEST	1.1.1.1	192.168.2.17	0x28c5	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:11.783639908 CEST	1.1.1.1	192.168.2.17	0x28c5	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:11.783735991 CEST	1.1.1.1	192.168.2.17	0xfbee	No error (0)	maxcdn.bootstrapcdn.com			65	IN (0x0001)	false
Apr 26, 2024 21:23:11.788841009 CEST	1.1.1.1	192.168.2.17	0x8fda	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 21:23:11.788958073 CEST	1.1.1.1	192.168.2.17	0xb6a3	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 21:23:12.686099052 CEST	1.1.1.1	192.168.2.17	0x6fad	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Apr 26, 2024 21:23:12.686525106 CEST	1.1.1.1	192.168.2.17	0x8e84	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.686525106 CEST	1.1.1.1	192.168.2.17	0x8e84	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.746386051 CEST	1.1.1.1	192.168.2.17	0xb784	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.746386051 CEST	1.1.1.1	192.168.2.17	0xb784	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.746386051 CEST	1.1.1.1	192.168.2.17	0xb784	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:12.746386051 CEST	1.1.1.1	192.168.2.17	0xb784	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:13.425539970 CEST	1.1.1.1	192.168.2.17	0x5530	No error (0)	onetw.wanglinfeng.com			65	IN (0x0001)	false
Apr 26, 2024 21:23:13.461150885 CEST	1.1.1.1	192.168.2.17	0xbe30	No error (0)	onetw.wanglinfeng.com		104.21.89.211	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:13.461150885 CEST	1.1.1.1	192.168.2.17	0xbe30	No error (0)	onetw.wanglinfeng.com		172.67.147.90	A (IP address)	IN (0x0001)	false
Apr 26, 2024 21:23:15.357023001 CEST	1.1.1.1	192.168.2.17	0x100b	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

open.camscanner.com

slscr.update.microsoft.com

fs.microsoft.com

onetw.wanglinfeng.com

https:

maxcdn.bootstrapcdn.com

cdnjs.cloudflare.com

code.jquery.com

a.nel.cloudflare.com

login.live.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49701	54.94.125.253	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:22:53 UTC	760	OUT	GET /doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X HTTP/1.1 Host: open.camscanner.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:22:55 UTC	601	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:22:54 GMT Content-Type: application/pdf Content-Length: 135816 Connection: close Content-Disposition: attachment;filename="ProjectUpdate-X.pdf" Last-Modified: Fri, 26 Apr 2024 19:22:54 GMT Expires: Sat, 27 Apr 2024 19:22:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST Access-Control-Expose-Headers: X-IS-ERROR-CODE,X-IS-Error-Msg Access-Control-Allow-Headers: Content-Type,X-CSRF-TOKEN,X-REQUESTED-WITH,Content-Type,X-CSRF-TOKEN,X-REQUESTED-WITH,X-IS-DEVICE-ID,X-IS-TOKEN,X-IS-REQUEST-ID Server: Intsig Web Server
2024-04-26 19:22:55 UTC	3495	IN	Data Raw: 25 50 44 46 2d 31 2e 36 0d 25 ff ff ff ff 0a 32 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 65 6e 67 74 68 20 33 34 37 30 2f 53 75 62 74 79 70 65 2f 58 4d 4c 2f 54 79 70 65 2f 4d 65 74 61 64 61 74 61 3e 3e 73 74 72 65 61 6d 0a 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 31 20 37 39 2e 36 37 35 64 30 66 37 2c 20 32 30 32 33 2f 30 36 2f 31 31 2d 31 39 3a 32 31 3a 31 36 20 20 20 20 20 20 20 20 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a Data Ascii: %PDF-1.6%2 0 obj<</Length 3470/Subtype/XML/Type/Metadata>>stream<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.675d0f7, 2023/06/11-19:21:16 "> <rdf:RDF xmlns:
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 3f 78 70 61 63 6b 65 74 20 65 6e 64 3d 22 77 22 3f 3e 0d 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 34 20 30 20 6f 62 6a 0d 3c 3c 2f 42 69 74 73 50 65 72 43 6f 6d 70 6f 6e 65 6e 74 20 38 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 52 47 42 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 48 65 69 67 68 74 20 32 34 36 2f 4c 65 6e 67 74 68 20 31 30 37 34 31 2f 53 4d 61 73 6b 20 32 33 20 30 20 52 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 37 38 32 3e 3e 73 74 72 65 61 6d 0a 78 9c ed dd 79 70 55 45 be c0 f1 ac 14 45 85 62 29 a0 08 58 54 2a 02 0f 15 10 07 04 74 80 42 2a c8 a0 c8 a0 0c Data Ascii: <?xpacket end="w"?>endstreamendobj14 0 obj<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/FlateDecode/Height 246/Length 10741/SMask 23 0 R/Subtype/Image/Type/XObject/Width 782>>streamxypUEEb)XTtB
2024-04-26 19:22:55 UTC	4091	IN	Data Raw: 38 0b 28 f9 c5 f2 8f 88 67 e4 f8 67 cd 9a e5 77 80 c6 0c df dd 7b f6 d9 67 75 ca 91 0b 29 fd 9b 23 47 8e 08 7f 73 fd fa f5 ab 57 af aa 4b 86 73 ff a5 7e 04 cd 66 56 eb d7 af b7 df 26 a6 76 7e 2c 2a 2a 52 19 da b9 72 d4 bf 9a 9a da 61 ed 11 6d a5 c8 94 d4 e8 92 6f 21 be f1 c6 1b 3a e5 e8 64 4a af bd f6 9a 7e 9b 97 e7 6c a6 14 63 f4 5d 68 d9 b2 a5 c9 56 d4 b5 63 c7 0e cb 31 97 31 7c 69 b1 82 bc bc bc 4b 97 2e 95 0d fe 8b 17 2f aa 6f b1 fa 2e eb 97 50 79 5f e7 b9 65 99 1a 21 ce aa 10 49 d5 aa 55 7d 0c 26 38 36 6f de ec cb 48 d0 24 07 5f 59 96 5f 3b 7d fa b4 70 14 9a cb 66 ca 4d a1 fe 40 58 d3 66 cd 9a 35 69 69 69 91 e6 a7 a5 a4 a4 bc fa ea ab 72 f9 65 d4 29 da e6 d2 01 fa 73 33 de 7e fb 6d 61 ae 45 e3 c6 8d 27 4e 9c 58 5c 5c ac 53 d4 ed b7 df 6e 36 ce 4a 91 Data Ascii: 8(ggw{gu)#GsWKs~fV&v~,**Rramo!:dJ~lc]hVc11\|iK./o.Py_e!IU}&86oH$_Y_;}pfM@Xf5iiire)s3~maE'NX\\Sn6J
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: c1 d8 5b bf 7e bd 61 24 41 78 06 77 ea d4 29 39 c8 af bf fe da 42 b1 72 99 4e 1f 84 56 bd 86 99 92 b2 77 ef 5e a1 84 d7 5f 7f dd bd c8 6d 0a 54 a6 a4 7e d9 e5 01 60 73 18 44 5f a6 14 23 0e dd 0a df c1 b1 63 c7 46 fa 4b fd dd e2 42 d5 ad 5b d7 a5 fe 42 c0 a5 a5 a5 c9 5d ef 88 d0 4c a9 77 ef de 1e d4 0b 6b 8a 8b 8b e3 e2 e2 dc 1e 7b 86 a7 9d 52 6d da b4 71 3b 12 c1 8a 15 2b 0c 23 b4 f6 ce 97 5c a6 e3 07 a2 53 af 4e a6 24 6f 69 9d 97 97 e7 5e e4 36 05 27 53 6a dd ba b5 dc fb a5 9e 7a ea 29 cb 55 44 65 a6 34 6c d8 30 cd 83 3a 79 f2 64 d8 3f bb 78 f1 a2 cd 18 e4 c5 6d 3e f9 e4 13 9b e5 23 b0 3c d8 a3 36 34 53 62 46 77 c0 d5 ab 57 cf 83 b1 f7 d6 5b 6f e9 04 e3 d7 66 70 3a 1b 23 5a 5e 9b 57 2e d6 d1 e3 d0 ad 57 27 53 32 8c dc ce ef bb ab 02 92 29 3d f4 d0 43 72 Data Ascii: [~a$Axw)9BrNVw^_mT~`sD_#cFKB[B]Lwk{Rmq;+#\SN$oi^6'Sjz)UDe4l0:yd?xm>#<64SbFwW[ofp:#Z^W.W'S2)=Cr
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: ff ec d9 b3 51 de 4e 9c 38 21 91 c8 8a 15 2b ee dc b9 83 89 56 28 7d 7c 11 2c 99 5f 04 5a 48 cc 88 bf 7d fb c6 d1 42 6e a6 fc ea d5 2b a4 16 6a 4f d4 fa e6 17 42 bd db d7 42 74 39 c7 f1 1f 68 21 27 44 40 a5 52 89 d5 42 e8 22 1e a6 08 9c 7e c1 f7 af 76 7e 41 f6 0b d1 4c 97 2d 5b 06 b5 c0 5f 43 88 da ec e8 e8 e0 68 21 2a b4 a8 16 06 e7 17 94 16 54 bf 9b 9d 9d bd 75 eb d6 86 0d 1b a2 0e f7 f5 eb 57 d2 5b b5 5a 85 e1 fd 47 70 fe fc f9 f6 f6 f6 d8 74 2e 5c b8 c0 8c 16 da 1f 3e 7c 98 f4 7f f5 ea 55 6a 53 48 0b e5 a7 a6 10 4c 18 61 ef 0e 3d 44 ad 3d 98 ba fb cb 21 d2 86 d9 bb a3 0e dd d3 d3 c3 89 ff d7 af 5f 70 17 68 ef 8b 8b 49 93 8f da f9 05 f3 54 80 09 83 d4 82 bf e3 c4 c4 04 33 12 d2 86 d9 bb f9 01 44 a5 b3 7e fd fa 28 63 d2 5e 89 16 a2 bd 1b f9 2f d2 00 13 Data Ascii: QN8!+V(}\|,_ZH}Bn+jOBBt9h!'D@RB"~v~AL-[_Ch!*TuW[ZGpt.\>\|UjSHLa=D=!_phIT3D~(c^/
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: b6 07 a0 89 e9 90 46 40 81 1e 78 fb 05 9b 76 d3 22 81 f4 29 76 6c 39 f1 8b f2 58 9a 76 62 fe 9b ed 55 05 13 6b 5a a3 2d 8c fd cd 2a 60 17 b8 b6 c6 13 92 e9 56 4d ab f0 af ba 7a f0 7c 97 5c cd e3 04 5d 69 9a de cb 32 e6 bf bb cd 71 b2 33 db ec 75 7f 81 27 cf 7f b5 1a 6c 6b ae 6c f3 59 54 ce d5 6d 18 be a1 03 33 31 ee e5 39 d3 d0 b8 83 9e eb e1 a5 ee 80 f9 98 b6 2d b5 db 6f a7 79 eb 72 7e 23 3e e6 01 98 44 0b 6a 46 f5 1a c6 a1 56 60 6b 73 05 2f e3 6e e5 2c 3b bb 95 7b 60 f4 bf 7d c9 29 ed d2 a8 af da 62 78 e0 c2 39 97 3c 5f 24 76 a8 30 44 85 07 d2 19 95 ec 51 51 ba 48 70 89 8a 05 4a 70 52 40 a2 c8 38 24 9d 48 11 4a 52 85 38 46 45 6b e4 8e 74 24 51 85 b8 20 1d 48 67 52 81 4a 62 d2 89 b4 e6 61 9f 62 97 a2 12 4e a2 53 12 89 4a a9 cf 84 fa 4c a9 7a 42 7d 1e 22 Data Ascii: F@xv")vl9XvbUkZ-*`VMz\|\]i2q3u'lklYTm319-oyr~#>DjFV`ks/n,;{`})bx9<_$v0DQQHpJpR@8$HJR8FEkt$Q HgRJbabNSJLzB}"
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: 14 1e 66 76 3e 4b 18 f2 b9 3a 31 a8 81 bf 39 26 35 98 b4 a9 55 03 cd 28 0a ce a7 ca f1 f9 cc fc 01 41 a4 da aa 76 0d 38 ab d4 e2 ed 5d af f2 e3 4a 0e c3 52 d9 42 9a 38 cd a7 37 34 ad cc f3 8b c3 a0 a6 5b 2a 4b 1d bd 99 1a 26 95 cb 6c d9 f3 e9 97 85 af 90 8e aa 06 5a 9d bc 9e 17 93 1a 8e 33 38 6b d5 40 59 49 ab c3 5e 62 09 a8 f4 b8 27 3c e6 58 22 16 99 0d 42 13 5b 52 e2 16 eb d7 b1 c8 af 8a e6 ed df 71 b4 8f 8d ab 7c 7a 43 4a bd 31 ea 09 a1 4f 5b 5a c6 48 01 99 dd 85 19 53 83 b8 7d a8 db d3 cc 50 e1 7d 26 ab 32 aa 1a e8 25 87 f4 dd 24 35 f4 32 38 6b d5 c0 66 f0 87 6f 95 56 94 0f 8d e6 a5 c2 e1 01 4b ff 45 d2 d0 f5 a1 9a d3 c1 71 3e c6 bd 45 eb 9d 3d 5f 59 c7 80 d7 2a 07 cd 52 1d 1f 0e 11 55 ac e1 c5 14 90 d9 5d 98 8d 57 94 b9 13 87 1a de 15 7e d2 c4 1f 52 Data Ascii: fv>K:19&5U(Av8]JRB874[K&lZ38k@YI^b'<X"B[Rq\|zCJ1O[ZHS}P}&2%$528kfoVKEq>E=_YRU]W~R
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: 33 78 e9 87 7d 62 12 e6 a1 48 cb 90 61 06 f1 3d 4c 6a cf 54 59 e1 a7 8c 0c e6 5e c0 db aa 3d 99 80 6a 2d e8 0c 3f c3 86 92 2b 1d 7a 12 19 af b6 a8 18 78 35 75 5e 2e 9a 2e 18 f0 4b 16 1e b4 72 47 13 03 3e fa 10 82 a5 27 f3 45 bf e7 0c b8 70 45 1c 30 30 3e ce 53 4b 87 f7 e0 42 2f fd 00 7a 72 e3 85 3c 7e 5b 52 e4 81 60 28 b9 70 a1 4f 2b 79 50 3f 3f d7 80 e0 e2 7d 4c 5b 9d c7 5f 05 b5 af 18 aa 86 c2 9f f2 7d c4 60 45 20 7a 52 89 7f 0f 18 90 f0 83 0d 85 36 e5 88 c1 56 08 9d 01 ad fe 2d 8f b8 f4 24 bc 85 5a 0b 3b 82 5d 3f bc 56 46 88 9e dc 94 8b a6 0a 86 34 fe ec d2 f2 52 6a cb cb 4b df c1 95 c1 fa 61 72 f6 22 88 e8 67 75 f2 92 bc fe 93 9c c1 72 56 5b f5 03 d9 93 8c fa f2 f5 15 fd 30 51 ae 97 fb bd 5b c3 40 20 68 fd 50 e9 07 6c 43 ad 70 8f 28 3d 2d 37 35 e7 c1 Data Ascii: 3x}bHa=LjTY^=j-?+zx5u^..KrG>'EpE00>SKB/zr<~[R`(pO+yP??}L[_}`E zR6V-$Z;]?VF4RjKar"gurV[0Q[@ hPlCp(=-75
2024-04-26 19:22:55 UTC	4096	IN	Data Raw: ea 16 4a 5f 05 44 07 45 05 a2 2f f8 be 04 5d 15 ae 4f 89 66 8a db 59 89 63 15 8e 4e d1 69 ad 25 23 8a 3d 81 89 05 55 78 bb 51 7d 33 2c 8e 0c 59 d9 24 0e 41 b3 af 8d 67 c9 6a 14 23 0f 40 dc 71 24 b4 77 de e3 38 3b a1 5b c2 d9 21 de 7e 62 fd 31 eb 2e 6c 54 56 de 72 bc c1 33 33 65 50 aa e9 78 6b a0 66 6e 69 31 05 9e b8 02 c5 cb 14 d8 c5 9a 51 49 ac 16 6f 05 b0 58 70 da 7a b3 e7 89 57 a5 63 52 9b 32 35 45 63 ae 71 cb 24 07 de 20 4a a2 00 2e 3a 2a b6 4f 82 bd a6 5c 78 a1 cb 45 da 59 76 52 27 de cd 49 bc a6 b5 c6 5b 2c 63 64 8e fb 72 34 99 2d 9e 05 3d b3 75 5d d9 7c 01 5c 06 13 07 d3 1d 02 43 11 67 2d d6 ca 99 56 4f 3d 56 a6 74 11 33 62 6f b1 5b 1c a3 1d e2 43 ab 3c 41 a0 12 93 d4 b5 2d b0 fc b1 ea c4 a6 69 ae b6 bb e7 61 b1 a3 c1 fc ca 96 fc 16 71 45 ad ae f2 Data Ascii: J_DE/]OfYcNi%#=UxQ}3,Y$Agj#@q$w8;[!~b1.lTVr33ePxkfni1QIoXpzWcR25Ecq$ J.:*O\xEYvR'I[,cdr4-=u]\|\Cg-VO=Vt3bo[C<A-iaqE
2024-04-26 19:22:55 UTC	2192	IN	Data Raw: d3 d9 8f 59 3a 2d 9d 5f 1e 67 fb b2 63 63 a7 a5 a3 dd 10 ca fc b5 ba 81 ca 9b b0 7e c7 8f 76 1e c6 1b 16 f9 ce 91 22 af 5c 02 1d ac d5 f8 c6 78 6b c7 c3 1d f7 1c 17 83 62 56 c1 66 b2 59 6c 36 ab 64 55 18 7f 0d ab 63 0b 11 99 b3 58 3d 5b c4 16 6b b9 c5 28 5b 80 cf f9 c8 cd 85 17 4e 13 4d 1f f3 5a c2 1a 80 46 b6 9c 35 b1 15 f8 6a 80 5e e6 cb 89 b2 a5 5a be 89 ad c4 d7 2a 76 36 5b cd ce 61 6b d8 5a df e7 4a cd b2 06 25 ab b5 fc 2a e0 5c 76 1e 66 e6 7c 76 81 a6 24 93 e5 42 76 11 5b 87 59 bb 84 5d ca 2e 3b 65 ee b2 2e d5 c2 d6 b3 cb 31 cf 57 b0 2b 4f aa 37 f4 c8 5d 85 af ab d9 35 58 0f 9b d8 b5 ec 3a 76 03 d6 c5 4d ec e6 e3 ac d7 6b f6 1b d9 ad 6c 0b d6 8c 28 bb 16 96 2d 9a 12 a5 8f b1 e7 d9 0e f6 10 7b 98 3d a2 c5 b2 1a 51 a3 88 c8 b8 cc d7 62 d8 80 18 ac c1 Data Ascii: Y:-_gcc~v"\xkbVfYl6dUcX=[k([NMZF5j^Zv6[akZJ%\vf\|v$Bv[Y].;e.1W+O7]5X:vMkl(-{=Qb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49709	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:07 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ORsMknvcz1PKnFR&MD=28FNTYEb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 19:23:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bdbbe626-9fac-4401-aa1f-5d4bb293f119 MS-RequestId: 3cc7aa01-e3a2-40d3-a6de-9825d16c1284 MS-CV: z7yvBwvV9kWRpnBX.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 19:23:07 GMT Connection: close Content-Length: 24490
2024-04-26 19:23:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 19:23:07 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49710	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:07 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 19:23:07 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=42038 Date: Fri, 26 Apr 2024 19:23:07 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49713	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:08 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 19:23:08 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=42031 Date: Fri, 26 Apr 2024 19:23:08 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 19:23:08 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49714	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:11 UTC	659	OUT	GET /minetake/ HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:11 UTC	637	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cnbtYQXWwFv3%2BbB9rGhD2E4fr5tU%2FMiBrK9UAvueotrmJrfgtegyxJaFXSSjOcL1CrkLBRPZf4C4Af%2BDN8IZ3whPCgsp8AGn%2BMZVFdHDl3yzFAQDm8CDZvW8syHDjIppdZfhr3q1Poo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2244ed1747e-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:11 UTC	732	IN	Data Raw: 31 62 31 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 34 2e 30 2e 30 2f 63 73 Data Ascii: 1b1f<!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/cs
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 73 2c 0d 0a 20 20 20 20 2e 62 74 6e 3a 61 63 74 69 76 65 2c 0d 0a 20 20 20 20 2e 62 74 6e 2e 61 63 74 69 76 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 62 6f 78 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 36 70 78 20 72 67 62 28 30 20 30 20 30 20 2f 20 32 30 25 29 3b 0d 0a 20 20 20 20 20 20 20 20 2f 2a 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 Data Ascii: s, .btn:active, .btn.active { outline: 0px !important; -webkit-appearance: none; box-shadow: none !important; } .box { box-shadow: 0 2px 6px rgb(0 0 0 / 20%); /*border: 1px solid rgba(0, 0
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 23 66 6f 6f 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 3b 0d 0a 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 3b 0d 0a 20 20 20 20 20 20 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 Data Ascii: margin-bottom: 28px; background-color: white; } #footer { position: fixed; bottom: 0px; width: 100%; overflow: visible; z-index: 99; clear: both; background-color: #00
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 62 6f 78 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 20 30 2c Data Ascii: background-size: cover; background-repeat: no-repeat; background-image: none; background-color: white; } .box { box-shadow: none; /*border: 1px solid rgba(0, 0,
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 20 69 6e 66 69 6e 69 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 6f 72 62 69 74 3b 0d 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 33 73 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6c 6f 61 64 65 72 20 2e 63 69 72 63 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 Data Ascii: animation-iteration-count: infinite; animation-name: orbit; animation-duration: 3s; } .loader .circle:after { content: ""; position: absolute; width: 3px; height: 3px; bord
2024-04-26 19:23:11 UTC	743	IN	Data Raw: 75 6e 63 74 69 6f 6e 3a 20 65 61 73 65 2d 6f 75 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 37 36 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 33 30 30 70 78 2c 20 30 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 33 35 30 70 78 2c 20 30 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 70 61 63 69 74 79 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 Data Ascii: unction: ease-out; } 76% { transform: translate(300px, 0); opacity: 0; } 100% { transform: translate(350px, 0); opacity: 0; } } </style></head
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 31 37 33 65 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 6c 65 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 Data Ascii: 173e <div class="circle"></div> <div class="circle"></div> <div class="circle"></div> </div> <di
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 72 6f 75 6e 64 65 64 2d 30 20 74 65 78 74 2d 77 68 69 74 65 20 70 78 2d 34 20 77 2d 32 35 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 6c 69 67 68 74 67 72 65 79 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 22 3e 42 61 63 6b 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 72 6f 75 6e 64 65 64 Data Ascii: <button type="button" class="btn rounded-0 text-white px-4 w-25" style="background-color: lightgrey;color:black !important;cursor: pointer;">Back</button> <button type="button" class="btn rounded
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 69 6f 6e 22 20 63 6c 61 73 73 3d 22 5f 5f 63 66 5f 65 6d 61 69 6c 5f 5f 22 20 64 61 74 61 2d 63 66 65 6d 61 69 6c 3d 22 36 65 30 66 30 63 30 64 32 65 30 66 30 63 30 64 34 30 30 64 30 31 30 33 22 3e 5b 65 6d 61 69 6c 26 23 31 36 30 3b 70 72 6f 74 65 63 74 65 64 5d 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 79 2d 32 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 35 22 3e 45 6e 74 65 72 20 50 61 73 73 77 6f 72 64 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 62 2d 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: ion" class="__cf_email__" data-cfemail="6e0f0c0d2e0f0c0d400d0103">[email protected]</a></span> <div class="py-2"><span class="h5">Enter Password</span></div> <div class="pb-2">
2024-04-26 19:23:11 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 78 22 20 69 64 3d 22 70 61 61 61 61 72 74 33 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 78 74 65 78 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 5f 61 5f 65 75 70 61 79 66 67 67 68 71 69 61 69 37 6b 39 73 6f 6c 36 6c 67 32 2e 69 63 6f 22 20 63 6c 61 73 73 Data Ascii: </div> <div class="box" id="paaaart3" style="display: none;"> <div class="boxtext"> <img src="images/favicon_a_eupayfgghqiai7k9sol6lg2.ico" class

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49715	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:11 UTC	598	OUT	GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onetw.wanglinfeng.com/minetake/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:11 UTC	756	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:11 GMT Content-Type: application/javascript Content-Length: 1239 Connection: close Last-Modified: Fri, 19 Apr 2024 20:54:07 GMT ETag: "6622d9ef-4d7" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wprXW4zyao7cuYzOetpuM7Tjp9UQyorYru8Yp%2FOKrw5TjrOeBTK%2BCWob9M3zTgyFRYkPSe0zhXek2CnnqT5TThr1QSSQM6oHPVEBk3Rpl6i3nGwDFAHDdaVzNkKpv7ZYuvAn2IY4dJs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2266d4c3707-MIA X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Sun, 28 Apr 2024 19:23:11 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-04-26 19:23:11 UTC	613	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 74 72 79 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 29 72 65 74 75 72 6e 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 3f 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 3a 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 20 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 61 20 68 72 65 66 3d 22 27 2b 65 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2b 27 22 3e 3c 2f 61 3e 27 2c 64 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 30 5d 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 Data Ascii: !function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href
2024-04-26 19:23:11 UTC	626	IN	Data Raw: 2e 68 72 65 66 2c 61 2b 6c 2e 6c 65 6e 67 74 68 29 29 7d 63 61 74 63 68 28 69 29 7b 65 28 69 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 75 29 2c 63 3d 30 3b 63 3c 72 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 74 72 79 7b 76 61 72 20 6f 3d 72 5b 63 5d 2c 61 3d 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 69 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 66 29 3b 69 66 28 69 29 7b 76 61 72 20 6c 3d 6e 28 69 2c 30 29 2c 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6c 29 3b 61 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 64 2c 6f 29 7d 7d 63 61 74 63 68 28 68 29 7b 65 28 68 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 61 28 74 29 7b 66 6f 72 28 76 61 72 20 Data Ascii: .href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49716	104.18.11.207	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:12 UTC	579	OUT	GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://onetw.wanglinfeng.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:12 UTC	931	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:12 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"450fc463b8b1a349df717056fbb3e078" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-CachedAt: 03/18/2024 12:50:25 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 625 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: a60a179c72e9d869f9402e4425eeeaf7 CDN-Cache: HIT CF-Cache-Status: HIT Age: 802844 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 87a8f229dc76a69b-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:12 UTC	438	IN	Data Raw: 37 63 31 30 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 3a 72 6f 6f 74 7b 2d 2d 62 6c 75 65 3a 23 30 30 37 62 66 66 3b 2d 2d 69 6e 64 69 67 6f 3a 23 36 36 31 30 Data Ascii: 7c10/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */:root{--blue:#007bff;--indigo:#6610
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 61 72 79 3a 23 30 30 37 62 66 66 3b 2d 2d 73 65 63 6f 6e 64 61 72 79 3a 23 36 63 37 35 37 64 3b 2d 2d 73 75 63 63 65 73 73 3a 23 32 38 61 37 34 35 3b 2d 2d 69 6e 66 6f 3a 23 31 37 61 32 62 38 3b 2d 2d 77 61 72 6e 69 6e 67 3a 23 66 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 73 6d 3a 35 37 36 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6d 64 3a 37 36 38 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 6c 67 3a 39 39 32 70 78 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 6c 3a 31 32 30 30 70 78 3b 2d 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 2d 73 61 6e Data Ascii: ary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-san
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 20 64 6f 74 74 65 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 20 64 6f 74 74 65 64 3b 63 75 72 73 6f 72 3a 68 65 6c 70 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 7d 61 64 64 72 65 73 73 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 6c 20 75 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 64 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 64 64 7b 6d 61 72 67 69 Data Ascii: ion:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:normal;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margi
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 74 6f 20 2d 77 65 62 6b 69 74 2d 66 6f 63 75 73 2d 72 69 6e 67 2d 63 6f 6c 6f 72 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 2c 62 75 74 74 6f 6e 2c 68 74 6d 6c 20 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 7b 2d 77 65 62 6b Data Ascii: to -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webk
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 2d 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 2c 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 7d 2e 68 32 2c 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 7d 2e 68 33 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 35 72 65 6d 7d 2e 68 34 2c 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 7d 2e 68 35 2c 68 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 7d 2e 68 36 2c 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 7d 2e 6c 65 61 64 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 Data Ascii: -bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25rem;font-weig
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 46 4d 6f 6e 6f 2d 52 65 67 75 6c 61 72 2c 4d 65 6e 6c 6f 2c 4d 6f 6e 61 63 6f 2c 43 6f 6e 73 6f 6c 61 73 2c 22 4c 69 62 65 72 61 74 69 6f 6e 20 4d 6f 6e 6f 22 2c 22 43 6f 75 72 69 65 72 20 4e 65 77 22 2c 6d 6f 6e 6f 73 70 61 63 65 7d 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 37 2e 35 25 3b 63 6f 6c 6f 72 3a 23 65 38 33 65 38 63 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 61 3e 63 6f 64 65 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 6b 62 64 7b 70 61 64 64 69 6e 67 3a 2e 32 72 65 6d 20 2e 34 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 38 37 2e 35 25 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 32 35 32 39 3b 62 6f 72 64 65 72 2d 72 61 64 69 Data Ascii: ont-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace}code{font-size:87.5%;color:#e83e8c;word-break:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:87.5%;color:#fff;background-color:#212529;border-radi
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 2e 63 6f 6c 2d 6d 64 2c 2e 63 6f 6c 2d 6d 64 2d 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 30 2c 2e 63 6f 6c 2d 6d 64 2d 31 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 32 2c 2e 63 6f 6c 2d 6d 64 2d 33 2c 2e 63 6f 6c 2d 6d 64 2d 34 2c 2e 63 6f 6c 2d 6d 64 2d 35 2c 2e 63 6f 6c 2d 6d 64 2d 36 2c 2e 63 6f 6c 2d 6d 64 2d 37 2c 2e 63 6f 6c 2d 6d 64 2d 38 2c 2e 63 6f 6c 2d 6d 64 2d 39 2c 2e 63 6f 6c 2d 6d 64 2d 61 75 74 6f 2c 2e 63 6f 6c 2d 73 6d 2c 2e 63 6f 6c 2d 73 6d 2d 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 30 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 32 2c 2e 63 6f 6c 2d 73 6d 2d 33 2c 2e 63 6f 6c 2d 73 6d 2d 34 2c 2e 63 6f 6c 2d 73 6d 2d 35 2c 2e 63 6f 6c 2d 73 6d 2d 36 2c 2e 63 6f 6c 2d 73 6d 2d 37 2c Data Ascii: .col-md,.col-md-1,.col-md-10,.col-md-11,.col-md-12,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-auto,.col-sm,.col-sm-1,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 36 36 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 39 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 37 35 25 3b 66 6c 65 78 3a 30 20 30 20 37 35 25 3b 6d 61 78 2d 77 69 64 74 68 3a 37 35 25 7d 2e 63 6f 6c 2d 31 30 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 38 33 2e 33 33 33 33 33 33 25 3b 66 6c 65 78 3a 30 20 30 20 38 33 2e 33 33 33 33 33 33 25 3b 6d 61 78 2d 77 69 64 74 68 3a 38 33 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 31 31 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 Data Ascii: 7%;max-width:66.666667%}.col-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-10{-webkit-box-flex:0;-ms-flex:0 0 83.333333%;flex:0 0 83.333333%;max-width:83.333333%}.col-11{-webkit-box-flex:0;-ms-flex:0 0 91.666667%;flex:0 0 91.666667
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 37 25 7d 2e 6f 66 66 73 65 74 2d 33 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 35 25 7d 2e 6f 66 66 73 65 74 2d 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 33 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 31 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 36 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 25 7d 2e 6f 66 66 73 65 74 2d 37 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 37 25 7d 2e 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 25 7d 2e 6f 66 66 73 65 74 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 33 2e 33 33 33 33 33 33 25 7d 2e 6f 66 66 73 65 74 2d Data Ascii: 7%}.offset-3{margin-left:25%}.offset-4{margin-left:33.333333%}.offset-5{margin-left:41.666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.333333%}.offset-8{margin-left:66.666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.333333%}.offset-
2024-04-26 19:23:12 UTC	1369	IN	Data Raw: 64 74 68 3a 38 33 2e 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 73 6d 2d 31 31 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 25 3b 66 6c 65 78 3a 30 20 30 20 39 31 2e 36 36 36 36 36 37 25 3b 6d 61 78 2d 77 69 64 74 68 3a 39 31 2e 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 73 6d 2d 31 32 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 2d 6d 73 2d 66 6c 65 78 3a 30 20 30 20 31 30 30 25 3b 66 6c 65 78 3a 30 20 30 20 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 6f 72 64 65 72 2d 73 6d 2d 66 69 72 73 74 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 30 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 2d 31 3b 6f 72 64 65 72 3a Data Ascii: dth:83.333333%}.col-sm-11{-webkit-box-flex:0;-ms-flex:0 0 91.666667%;flex:0 0 91.666667%;max-width:91.666667%}.col-sm-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-sm-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49719	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:12 UTC	649	OUT	GET /minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetw.wanglinfeng.com/minetake/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	671	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:13 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3P5NGpxY1CGqjxWlm7w2EtZPXsbNEiPEp36dCO9YzQjjD53yrCYwcdBYR9AY5kbP6niSIG5AbPlE11KmuaVN%2Bie%2Bcm%2Fi51GSyuOkItJYcANq87u%2FPQULCoo1JBIuHuDqZ9p%2FHcxCvjE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f22e8f89a534-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:13 UTC	698	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 Data Ascii: 33333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 Data Ascii: """"""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333""""
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 Data Ascii: 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: DDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDD
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUU
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 Data Ascii: DDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDD
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 28 00 00 00 48 00 00 00 90 00 00 00 01 00 04 00 00 00 00 00 80 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (H"P
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49720	104.18.11.207	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:12 UTC	563	OUT	GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onetw.wanglinfeng.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:13 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"14d449eb8876fa55e1ef3c2cc52b0c17" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-CachedAt: 03/18/2024 12:50:25 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 878 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 282e717ce93d0df6b6ef2657d725226c CDN-Cache: HIT CF-Cache-Status: HIT Age: 1191978 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 87a8f22ee8d70321-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:13 UTC	423	IN	Data Raw: 37 63 30 32 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: 7c02/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2e 6b 65 79 2c 69 29 Data Ascii: ry","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 67 67 65 72 28 65 2e 65 6e 64 29 7d 2c 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 29 7d 2c 69 73 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 5b 30 5d 7c 7c 74 29 2e 6e 6f 64 65 54 79 70 65 7d 2c 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 73 29 29 7b 76 61 72 20 72 3d 6e 5b 73 5d 2c 6f 3d 65 5b 73 5d 2c 61 3d 6f 26 26 69 2e 69 73 45 6c 65 6d 65 6e 74 28 6f 29 3f 22 65 6c 65 6d 65 6e 74 22 3a 28 Data Ascii: gger(e.end)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var s in n)if(Object.prototype.hasOwnProperty.call(n,s)){var r=n[s],o=e[s],a=o&&i.isElement(o)?"element":(
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 6f 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6f 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5f 29 2c 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 6f 28 74 29 2e 68 61 73 43 6c 61 73 73 28 64 29 3f 6f 28 74 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 2c 6e 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 31 35 30 29 3a 74 68 69 73 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 29 7d 2c 65 2e 5f 64 Data Ascii: return o(t).trigger(e),e},e._removeElement=function(t){var e=this;o(t).removeClass(_),P.supportsTransitionEnd()&&o(t).hasClass(d)?o(t).one(P.TRANSITION_END,function(n){return e._destroyElement(t,n)}).emulateTransitionEnd(150):this._destroyElement(t)},e._d
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 7d 69 66 28 74 29 7b 69 66 28 69 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 29 72 65 74 75 72 6e 3b 69 2e 63 68 65 63 6b 65 64 3d 21 70 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 43 29 2c 70 28 69 29 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 69 2e 66 6f 63 75 73 28 29 2c 65 3d 21 31 7d 7d 65 26 26 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d Data Ascii: }if(t){if(i.hasAttribute("disabled")\|\|n.hasAttribute("disabled")\|\|i.classList.contains("disabled")\|\|n.classList.contains("disabled"))return;i.checked=!p(this._element).hasClass(C),p(i).trigger("change")}i.focus(),e=!1}}e&&this._element.setAttribute("aria-
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 45 41 56 45 3a 22 6d 6f 75 73 65 6c 65 61 76 65 22 2b 69 2c 54 4f 55 43 48 45 4e 44 3a 22 74 6f 75 63 68 65 6e 64 22 2b 69 2c 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 3a 22 6c 6f 61 64 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 5f 3d 22 63 61 72 6f 75 73 65 6c 22 2c 67 3d 22 61 63 74 69 76 65 22 2c 70 3d 22 73 6c 69 64 65 22 2c 6d 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 72 69 67 68 74 22 2c 76 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6c 65 66 74 22 2c 45 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6e 65 78 74 22 2c 54 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 70 72 65 76 22 2c 79 3d 7b 41 43 54 49 56 45 3a 22 2e 61 Data Ascii: EAVE:"mouseleave"+i,TOUCHEND:"touchend"+i,LOAD_DATA_API:"load"+i+".data-api",CLICK_DATA_API:"click"+i+".data-api"},_="carousel",g="active",p="slide",m="carousel-item-right",v="carousel-item-left",E="carousel-item-next",T="carousel-item-prev",y={ACTIVE:".a
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 6c 6c 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 26 26 21 74 68 69 73 2e 5f 69 73 50 61 75 73 65 64 26 26 28 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 2c 43 2e 74 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 66 69 6e 64 28 79 2e 41 43 54 49 56 45 5f 49 54 45 4d 29 5b 30 5d 3b 76 Data Ascii: ll),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},C.to=function(e){var n=this;this._activeElement=t(this._element).find(y.ACTIVE_ITEM)[0];v
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 74 65 73 74 28 74 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 29 29 73 77 69 74 63 68 28 74 2e 77 68 69 63 68 29 7b 63 61 73 65 20 33 37 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 70 72 65 76 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 39 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 6e 65 78 74 28 29 7d 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 73 3d 74 2e 6d 61 6b 65 41 72 72 61 79 28 74 28 65 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 79 2e 49 54 45 4d 29 29 2c 74 68 69 73 2e 5f 69 74 65 6d 73 2e 69 6e 64 65 78 4f 66 28 65 29 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 42 79 44 69 72 65 63 74 69 Data Ascii: test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},C._getItemIndex=function(e){return this._items=t.makeArray(t(e).parent().find(y.ITEM)),this._items.indexOf(e)},C._getItemByDirecti
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 67 65 74 3a 63 2c 64 69 72 65 63 74 69 6f 6e 3a 72 2c 66 72 6f 6d 3a 6c 2c 74 6f 3a 5f 7d 29 3b 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 70 29 3f 28 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 73 29 2c 50 2e 72 65 66 6c 6f 77 28 63 29 2c 74 28 61 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 61 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2b 22 20 22 2b 73 29 2e 61 64 64 43 6c 61 73 73 28 67 29 2c 74 28 61 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 67 2b 22 20 22 2b 73 2b 22 20 22 Data Ascii: get:c,direction:r,from:l,to:_});P.supportsTransitionEnd()&&t(this._element).hasClass(p)?(t(c).addClass(s),P.reflow(c),t(a).addClass(i),t(c).addClass(i),t(a).one(P.TRANSITION_END,function(){t(c).removeClass(i+" "+s).addClass(g),t(a).removeClass(g+" "+s+" "
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 74 28 79 2e 44 41 54 41 5f 52 49 44 45 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 3b 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 28 29 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 43 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 43 7d 28 65 29 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 63 6f 6c 6c 61 70 73 65 22 2c 6e 3d 22 62 73 2e 63 6f 6c 6c 61 70 73 65 22 2c 69 Data Ascii: t(y.DATA_RIDE).each(function(){var e=t(this);C._jQueryInterface.call(e,e.data())})}),t.fn[e]=C._jQueryInterface,t.fn[e].Constructor=C,t.fn[e].noConflict=function(){return t.fn[e]=o,C._jQueryInterface},C}(e),H=function(t){var e="collapse",n="bs.collapse",i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49722	104.17.24.14	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:12 UTC	569	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onetw.wanglinfeng.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	954	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:13 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 802278 Expires: Wed, 16 Apr 2025 19:23:13 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V0VUZMddzElkhMoC86G%2BTHrPaiKTzAOW9kbbT7jpfWDjKHZCyGsxR249EVHlyNdNn2ilOf6FSaCzHaXzd1uNzGxqVKscaIA50Gk1YU9mFzoglFLyIeT9g7luOCDrvu4T4NrCIpJu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 87a8f22f5dd93715-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:13 UTC	415	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 75 6d 65 6e 74 27 3a 72 65 74 75 Data Ascii: eType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':retu
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 27 62 6f 72 64 65 72 27 2b 6f 2b Data Ascii: =2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e['border'+o+
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d 72 65 74 75 72 6e 28 69 3f 6f 2e Data Ascii: p-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}return(i?o.
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 77 69 64 74 68 2c 69 3d Data Ascii: height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t=e.width,i=
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b 69 6e 73 74 61 6e 63 65 3a 74 68 Data Ascii: ('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={instance:th
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6f 2c 69 29 7b 76 61 72 20 72 3d 27 42 4f 44 59 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 72 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 65 3b 70 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 2c 7b 70 61 73 73 69 76 65 3a 21 30 Data Ascii: ions.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function H(e,t,o,i){var r='BODY'===e.nodeName,p=r?e.ownerDocument.defaultView:e;p.addEventListener(t,o,{passive:!0
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 79 20 27 2b 72 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 77 6f 72 6b 2c 20 62 65 20 73 75 72 65 20 74 6f 20 69 6e 63 6c 75 64 65 20 69 74 20 62 65 66 6f 72 65 20 27 2b 72 2b 27 21 27 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 74 75 72 6e 27 65 6e Data Ascii: ==t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required by '+r+' modifier in order to work, be sure to include it before '+r+'!')}return n}function K(e){return'en
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 2c 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 55 28 6f 29 26 26 28 6e 5b 74 5d 2b 3d 6f 2a 28 27 2d 27 3d 3d 3d 65 5b 69 2d 31 5d 3f 2d 31 3a 31 29 29 7d 29 7d 29 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 47 28 65 2c 74 Data Ascii: ==e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})}),a.forEach(function(e,t){e.forEach(function(o,i){U(o)&&(n[t]+=o*('-'===e[i-1]?-1:1))})}),n}function G(e,t
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6f 2c 65 7d 2c 73 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 2c 74 29 4f 62 Data Ascii: &e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e},se=Object.assign\|\|function(e){for(var t,o=1;o<arguments.length;o++)for(var i in t=arguments[o],t)Ob

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49723	151.101.66.137	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:13 UTC	544	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onetw.wanglinfeng.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	566	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 298018 Date: Fri, 26 Apr 2024 19:23:13 GMT X-Served-By: cache-lga21963-LGA, cache-pdk-kpdk1780032-PDK X-Cache: HIT, HIT X-Cache-Hits: 36, 0 X-Timer: S1714159393.232996,VS0,VE1 Vary: Accept-Encoding
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 5b 61 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 61 29 3b 72 65 74 75 72 6e 20 62 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 62 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 72 2e 65 61 63 68 28 74 68 69 73 2c 61 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 72 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 28 62 2c 63 2c 62 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 Data Ascii: [a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushSta
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6b 2e 63 61 6c 6c 28 61 29 29 26 26 28 21 28 62 3d 65 28 61 29 29 7c 7c 28 63 3d 6c 2e 63 61 6c 6c 28 62 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 6d 2e 63 61 6c 6c 28 63 29 3d 3d 3d 6e 29 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 66 6f 72 28 62 20 69 6e 20 61 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 Data Ascii: ject Object]"!==k.call(a))&&(!(b=e(a))\|\|(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typ
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6f 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 72 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 72 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6a 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 5d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 Data Ascii: now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"le
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4c 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4c 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4b 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4b 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4b Data Ascii: ")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"\|[])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\\("+K+"(even\|odd\|(([+-]\|)(\\d)n\|)"+K+"(?:([+-]\|)"+K+"*(\\d+)\|))"+K
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 3d 3d 77 26 26 31 31 21 3d 3d 77 29 72 65 74 75 72 6e 20 64 3b 69 66 28 21 65 26 26 28 28 62 3f 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 3a 76 29 21 3d 3d 6e 26 26 6d 28 62 29 2c 62 3d 62 7c 7c 6e 2c 70 29 29 7b 69 66 28 31 31 21 3d 3d 77 26 26 28 6c 3d 5a 2e 65 78 65 63 28 61 29 29 29 69 66 28 66 3d 6c 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 77 29 7b 69 66 28 21 28 6a 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 29 72 65 74 75 72 6e 20 64 3b 69 66 28 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 6a 29 2c 64 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6a 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 26 26 74 28 62 2c 6a 29 26 26 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 Data Ascii: ==w&&11!==w)return d;if(!e&&((b?b.ownerDocument\|\|b:v)!==n&&m(b),b=b\|\|n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 62 3f 62 2e 70 61 Data Ascii: ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.pa
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 75 29 2e 6c 65 6e 67 74 68 7d 29 2c 63 2e 67 65 74 42 79 49 64 3f 28 64 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 72 65 70 6c 61 63 65 28 5f 2c 61 61 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 Data Ascii: getElementsByName\|\|!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a)
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4b 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4b 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 4a 2b 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 75 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 7e 3d 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 75 2b 22 2b 2a 22 29 2e Data Ascii: .push("[^$]="+K+"(?:''\|\"\")"),a.querySelectorAll("[selected]").length\|\|q.push("\\["+K+"(?:value\|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length\|\|q.push("~="),a.querySelectorAll(":checked").length\|\|q.push(":checked"),a.querySelectorAll("a#"+u+"+").
2024-04-26 19:23:13 UTC	1378	IN	Data Raw: 65 29 69 66 28 62 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 42 3d 62 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 64 3d 21 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 64 3f 64 3a 28 64 3d 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 3d 3d 3d 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 29 3f 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 62 29 3a 31 2c 31 26 64 7c 7c 21 63 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 Data Ascii: e)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument\|\|a)===(b.ownerDocument\|\|b)?a.compareDocumentPosition(b):1,1&d\|\|!c.sortDetached&&b.compareDocu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49725	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:13 UTC	619	OUT	GET /minetake/images/key.svg HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetw.wanglinfeng.com/minetake/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	671	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:13 GMT Content-Type: image/svg+xml Content-Length: 1592 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5QFFhEO8JD%2B2B2HHRu4cjMe19Kntq5%2FYQ7ihgwe7Cl0MOp1A1JibLdRDO%2BZpOZDCJivBNWDBpYDj6qtoUqTEj8Lvn0E%2BGPydDk7u4MEsBPFqd%2BCcH0SRxB7FVShoYGad5tpVAJ4QSOA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2323e6774a2-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:13 UTC	698	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,
2024-04-26 19:23:13 UTC	894	IN	Data Raw: 31 30 2e 30 31 35 2c 30 2c 30 2c 31 2d 2e 31 32 35 2c 31 2e 35 37 38 2c 31 30 2e 38 37 39 2c 31 30 2e 38 37 39 2c 30 2c 30 2c 31 2d 2e 33 35 39 2c 31 2e 35 33 31 5a 6d 2d 32 2c 2e 38 34 34 4c 32 37 2e 32 31 39 2c 32 32 2e 36 34 31 61 31 34 2e 37 31 36 2c 31 34 2e 37 31 36 2c 30 2c 30 2c 30 2c 2e 35 36 32 2d 31 2e 37 38 32 41 37 2e 37 35 31 2c 37 2e 37 35 31 2c 30 2c 30 2c 30 2c 32 38 2c 31 39 61 38 2e 37 38 36 2c 38 2e 37 38 36 2c 30 2c 30 2c 30 2d 2e 37 2d 33 2e 35 2c 38 2e 39 2c 38 2e 39 2c 30 2c 30 2c 30 2d 31 2e 39 33 38 2d 32 2e 38 35 39 41 39 2e 32 36 39 2c 39 2e 32 36 39 2c 30 2c 30 2c 30 2c 32 32 2e 35 2c 31 30 2e 37 31 39 2c 38 2e 39 2c 38 2e 39 2c 30 2c 30 2c 30 2c 31 39 2c 31 30 61 38 2e 37 38 36 2c 38 2e 37 38 36 2c 30 2c 30 2c 30 2d 33 2e 35 Data Ascii: 10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49726	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:13 UTC	618	OUT	GET /minetake/images/bg.jpg HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetw.wanglinfeng.com/minetake/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:13 UTC	665	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:13 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zLidbnQSc8ZUGPoVpdlyJMQh5nb0NxeU5xpCa257FllJzAD%2FBNYGkgBgwQ%2BzVjKfLP6VGkhztg7keGULEbKMqxEGdfMFrSeoK3WkghORElnj9WGAR6f1S6kjFfSH7I2rR6BC%2Fqz69BQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2323d237446-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:13 UTC	704	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 00 00 00 00 00 50 10 00 00 01 05 40 01 41 15 14 40 00 00 50 00 00 00 00 00 04 00 00 00 11 40 00 00 00 00 00 00 00 04 00 40 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 00 44 01 01 44 01 68 80 28 80 2a 51 01 44 51 00 a5 00 00 00 01 15 00 01 00 05 00 44 14 45 00 40 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 44 01 44 15 54 45 a0 a8 00 a0 80 a0 00 00 00 00 a8 02 88 a0 00 02 a0 0a 22 80 00 00 00 00 00 03 ff d3 db 00 73 76 10 00 00 04 00 14 05 00 04 15 00 02 a0 20 00 08 a2 88 00 02 00 02 80 00 00 00 00 a8 02 8e 40 5a 54 01 69 50 11 68 80 29 50 05 10 51 4a 80 2d 01 02 80 a2 d2 a0 0b 44 10 75 47 2a 22 88 28 a2 50 14 00 51 14 40 00 00 50 00 00 04 00 00 00 00 00 00 00 10 01 45 a5 72 20 e8 41 45 57 35 50 51 28 22 88 a0 08 a0 22 80 00 a0 02 20 02 80 00 00 00 00 Data Ascii: P@A@P@@DDh(QDQDE@EDDTE"sv @ZTiPh)PQJ-DuG"(PQ@PEr AEW5PQ(""
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 80 00 00 08 00 00 00 00 28 8a 20 80 0a 08 0a 08 0a 80 00 02 00 20 00 00 00 00 00 00 00 02 28 08 00 00 20 00 20 02 82 28 82 00 00 00 00 00 02 00 00 00 00 00 00 20 a8 80 00 00 02 0a 82 00 00 00 00 02 00 00 00 00 01 40 16 95 00 74 39 5a 0a 25 50 00 00 01 40 00 00 00 00 00 14 40 14 45 00 00 00 00 05 05 40 14 45 00 00 51 14 14 40 14 00 00 14 00 1f ff d1 da 80 73 76 50 40 35 0d 00 00 50 00 11 44 10 00 01 05 00 00 00 00 01 15 10 00 14 04 d0 2a 00 00 00 00 00 00 00 0a 8b 80 00 20 00 00 00 a8 28 a2 00 aa 80 2a a0 22 82 00 02 a2 80 00 00 00 00 00 00 a0 00 0a 80 8a 02 20 00 00 28 a2 28 80 20 28 00 00 a0 00 00 08 00 00 00 00 00 00 a0 00 02 a0 00 00 00 02 02 80 00 08 00 02 2a 00 02 80 08 8a 80 0a 80 00 00 00 00 00 00 00 00 00 a8 00 00 08 00 00 00 00 00 00 08 a8 00 00 Data Ascii: ( ( ( @t9Z%P@@E@EQ@svP@5PD* (" (( (
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 02 20 02 88 a1 a0 80 20 20 00 00 00 00 00 80 00 00 80 00 20 28 20 00 00 00 00 02 02 a0 a0 91 14 41 00 00 00 00 05 10 a0 a0 02 0a 02 00 0a 20 0a 00 00 00 00 28 8a a8 00 00 02 80 00 00 2a b9 01 d0 95 40 00 00 00 01 40 00 50 10 00 05 11 40 45 15 40 01 ff d7 da 40 61 d8 00 00 10 00 01 00 54 00 00 00 40 00 00 54 51 15 05 40 11 50 00 00 00 00 10 00 00 00 11 40 40 14 00 01 50 05 40 00 01 14 45 05 54 00 00 40 05 00 00 00 00 50 01 54 00 10 04 00 01 00 00 01 41 51 40 01 05 00 40 00 00 50 11 40 00 05 40 14 41 45 00 41 51 50 00 04 01 50 54 00 50 10 00 00 00 00 00 00 00 00 00 00 00 00 01 05 00 40 10 14 10 15 00 15 00 01 14 0a 20 00 00 00 20 00 00 00 00 00 00 00 02 88 20 1a 20 80 a0 02 00 02 80 08 80 00 00 00 00 08 22 88 22 80 00 00 82 2a 00 00 00 00 00 00 20 00 02 00 Data Ascii: ( A (@@P@E@@aT@TQ@P@@P@ET@PTAQ@@P@@AEAQPPTP@ ""
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 28 00 00 02 a2 80 00 00 00 00 a0 00 2a 00 a0 28 00 0a 22 80 00 80 02 80 00 00 28 00 ff d5 da 80 65 d0 00 51 15 28 20 00 00 80 00 00 00 00 00 00 09 40 45 41 40 50 41 40 40 10 00 00 05 04 54 00 00 00 00 00 00 00 01 00 00 14 00 00 00 00 00 00 50 00 01 41 00 04 00 00 00 00 00 00 00 00 05 14 45 00 04 40 05 00 00 54 50 00 00 00 00 00 00 01 44 00 00 01 00 00 00 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 11 40 40 00 00 00 04 00 00 14 00 10 43 4d 40 00 50 00 40 04 00 05 00 01 15 01 00 11 50 00 00 00 10 00 04 00 00 10 00 10 00 00 10 41 50 00 00 00 04 50 00 00 00 00 00 00 14 45 50 00 00 00 01 00 00 51 15 40 00 00 05 00 00 00 00 00 05 00 05 00 00 00 5c 45 50 05 11 00 14 05 04 15 00 50 07 ff d6 da 80 65 d0 00 07 2e 90 10 00 00 14 01 00 Data Ascii: (*("(eQ( @EA@PA@@TPAE@TPD@@CM@P@PAPPEPQ@\EPPe.
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 02 80 08 8a 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 20 a8 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a2 00 20 00 02 28 00 00 88 ba 80 00 8a 00 20 00 0a 00 00 00 00 00 82 1a ba 80 8a 00 82 a0 00 00 00 00 00 8a 88 00 00 8a 02 0b 10 41 14 04 01 00 00 00 00 00 05 01 05 01 05 01 00 00 14 00 05 00 00 00 01 40 00 10 50 40 45 14 00 00 01 40 10 14 04 15 14 05 05 41 40 41 40 01 41 05 01 15 14 00 04 00 51 40 41 ff d4 da 80 46 80 01 00 00 00 00 00 01 40 00 00 11 15 00 00 00 00 00 00 00 10 10 54 01 44 01 44 01 44 01 44 00 00 00 00 00 00 14 00 40 00 00 00 01 50 00 00 00 00 00 00 00 00 00 00 00 01 55 00 51 00 14 00 01 40 00 00 40 50 10 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 00 00 00 01 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 Data Ascii: ( A@P@E@A@A@AQ@AF@TDDDD@PUQ@@PPQQ
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 00 00 0a 08 2a 28 00 02 a2 80 00 00 00 00 0a 00 82 80 80 a0 a0 28 00 00 28 3f ff d2 da 80 55 40 00 00 00 00 00 00 00 45 40 00 10 00 00 01 00 00 00 00 00 00 10 40 51 00 51 00 00 00 00 00 00 00 00 00 00 00 10 01 40 00 00 00 00 00 05 10 05 00 00 00 00 00 00 05 00 00 00 10 00 05 40 14 40 55 00 00 00 00 00 00 00 14 04 00 00 50 00 00 00 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 41 40 10 01 14 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 01 14 00 00 11 44 00 00 45 01 14 10 41 40 45 01 04 50 10 00 00 45 00 00 00 00 00 00 41 40 41 40 41 51 00 00 00 00 00 00 00 00 00 04 50 00 00 00 00 00 00 05 00 04 50 10 50 10 50 00 00 00 00 00 01 40 00 00 00 00 50 00 00 11 70 01 40 00 05 00 50 7f ff d3 da 80 51 00 00 00 00 00 00 04 50 10 00 10 05 10 05 10 00 00 00 00 Data Ascii: *(((?U@E@@QQ@@@UPA@DEA@EPEA@A@AQPPPP@Pp@PQP
2024-04-26 19:23:13 UTC	1369	IN	Data Raw: 28 00 02 00 00 00 00 00 00 8a 00 00 00 00 00 00 2a 28 80 08 00 00 00 a0 00 00 80 00 00 00 a0 00 00 00 8a 00 00 00 00 00 02 00 20 00 00 00 00 00 08 00 00 0a 8a 82 80 8a 00 00 08 a0 80 00 00 02 00 00 08 00 00 00 00 00 00 00 0a 22 80 22 80 80 00 00 00 00 00 00 00 a0 00 08 00 02 0a 8a 00 00 a8 a0 00 20 00 08 a0 a8 28 00 0a 80 00 00 00 28 08 a8 00 00 00 0a 0a 08 2a 28 00 00 00 ff d1 da 80 69 00 01 00 00 00 08 00 00 20 68 9a 00 0a 00 00 8a e4 00 00 14 04 04 00 00 00 00 54 50 01 10 00 00 14 10 40 00 00 00 00 50 00 00 00 00 00 00 14 10 01 00 01 54 45 00 00 00 01 51 40 00 00 00 00 05 00 51 14 50 04 00 00 00 00 00 00 00 54 01 40 14 00 00 00 00 00 00 10 00 00 04 50 00 00 00 00 01 44 00 00 04 00 00 00 50 00 00 40 00 00 50 00 00 01 40 10 00 00 00 00 10 00 00 10 00 00 Data Ascii: (( "" (((i hTP@PTEQ@QPT@PDP@P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49727	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:14 UTC	398	OUT	GET /minetake/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:14 UTC	669	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:14 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wy3DwQuHeECyJDw%2BLo%2FAEbNGCzwLvBOIrQOsNU8LEIY9slLFDKGmONB6H8H3KjAjJmWTdgtJ46E8Nlr0w0aDCoiuUGv7mXaJ3bZLOxouMGDZknKquxobDWjJTuvVuiR3k%2FK7XD%2BbtZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2365bf7a548-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:14 UTC	700	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: 333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 33333333333
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 Data Ascii: """"""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333""""""
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 Data Ascii: 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333""""""""""""""""""""""""""""""
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: DDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDD
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUU
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 Data Ascii: DDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDD
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 28 00 00 00 48 00 00 00 90 00 00 00 01 00 04 00 00 00 00 00 80 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (H"P
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 33333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49728	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:14 UTC	368	OUT	GET /minetake/images/key.svg HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:14 UTC	669	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:14 GMT Content-Type: image/svg+xml Content-Length: 1592 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awMY1wVIwYXo5qM3%2BcDiaxZPGxSL%2BQ7aap7O51nTJ79ADx0nclKGbmlA44gRJE3VP6ffbb%2BjjF8wtGw1rGdk1FcufmHG28HzJC3oOAg1gaqLWOhSTAko9UVjqbqHWuerXmhMhhcgk%2FA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2399cf00a02-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:14 UTC	700	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,
2024-04-26 19:23:14 UTC	892	IN	Data Raw: 2e 30 31 35 2c 30 2c 30 2c 31 2d 2e 31 32 35 2c 31 2e 35 37 38 2c 31 30 2e 38 37 39 2c 31 30 2e 38 37 39 2c 30 2c 30 2c 31 2d 2e 33 35 39 2c 31 2e 35 33 31 5a 6d 2d 32 2c 2e 38 34 34 4c 32 37 2e 32 31 39 2c 32 32 2e 36 34 31 61 31 34 2e 37 31 36 2c 31 34 2e 37 31 36 2c 30 2c 30 2c 30 2c 2e 35 36 32 2d 31 2e 37 38 32 41 37 2e 37 35 31 2c 37 2e 37 35 31 2c 30 2c 30 2c 30 2c 32 38 2c 31 39 61 38 2e 37 38 36 2c 38 2e 37 38 36 2c 30 2c 30 2c 30 2d 2e 37 2d 33 2e 35 2c 38 2e 39 2c 38 2e 39 2c 30 2c 30 2c 30 2d 31 2e 39 33 38 2d 32 2e 38 35 39 41 39 2e 32 36 39 2c 39 2e 32 36 39 2c 30 2c 30 2c 30 2c 32 32 2e 35 2c 31 30 2e 37 31 39 2c 38 2e 39 2c 38 2e 39 2c 30 2c 30 2c 30 2c 31 39 2c 31 30 61 38 2e 37 38 36 2c 38 2e 37 38 36 2c 30 2c 30 2c 30 2d 33 2e 35 2e 37 Data Ascii: .015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49729	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:14 UTC	367	OUT	GET /minetake/images/bg.jpg HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:14 UTC	663	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 19:23:14 GMT Content-Type: image/jpeg Content-Length: 17453 Connection: close Last-Modified: Tue, 05 Mar 2024 00:21:08 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=85vOUoHRXwS6kOKHIS00H9E%2FX3a%2Bp74kJbW1KT3v4OoCZ7qAQGdqQEh2w1QGK90yZCkEAhMjoig3fHPeRaYh4u3gXFxyibjDIHHU5O5GEMf8aPMZy8uSrCdnhHDjMxCGuxh7Ub7e9yY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f2399896a662-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:14 UTC	706	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 00 00 50 10 00 00 01 05 40 01 41 15 14 40 00 00 50 00 00 00 00 00 04 00 00 00 11 40 00 00 00 00 00 00 00 04 00 40 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 00 44 01 01 44 01 68 80 28 80 2a 51 01 44 51 00 a5 00 00 00 01 15 00 01 00 05 00 44 14 45 00 40 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 44 01 44 15 54 45 a0 a8 00 a0 80 a0 00 00 00 00 a8 02 88 a0 00 02 a0 0a 22 80 00 00 00 00 00 03 ff d3 db 00 73 76 10 00 00 04 00 14 05 00 04 15 00 02 a0 20 00 08 a2 88 00 02 00 02 80 00 00 00 00 a8 02 8e 40 5a 54 01 69 50 11 68 80 29 50 05 10 51 4a 80 2d 01 02 80 a2 d2 a0 0b 44 10 75 47 2a 22 88 28 a2 50 14 00 51 14 40 00 00 50 00 00 04 00 00 00 00 00 00 00 10 01 45 a5 72 20 e8 41 45 57 35 50 51 28 22 88 a0 08 a0 22 80 00 a0 02 20 02 80 00 00 00 00 00 00 Data Ascii: P@A@P@@DDh(QDQDE@EDDTE"sv @ZTiPh)PQJ-DuG"(PQ@PEr AEW5PQ(""
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 08 00 00 00 00 28 8a 20 80 0a 08 0a 08 0a 80 00 02 00 20 00 00 00 00 00 00 00 02 28 08 00 00 20 00 20 02 82 28 82 00 00 00 00 00 02 00 00 00 00 00 00 20 a8 80 00 00 02 0a 82 00 00 00 00 02 00 00 00 00 01 40 16 95 00 74 39 5a 0a 25 50 00 00 01 40 00 00 00 00 00 14 40 14 45 00 00 00 00 05 05 40 14 45 00 00 51 14 14 40 14 00 00 14 00 1f ff d1 da 80 73 76 50 40 35 0d 00 00 50 00 11 44 10 00 01 05 00 00 00 00 01 15 10 00 14 04 d0 2a 00 00 00 00 00 00 00 0a 8b 80 00 20 00 00 00 a8 28 a2 00 aa 80 2a a0 22 82 00 02 a2 80 00 00 00 00 00 00 a0 00 0a 80 8a 02 20 00 00 28 a2 28 80 20 28 00 00 a0 00 00 08 00 00 00 00 00 00 a0 00 02 a0 00 00 00 02 02 80 00 08 00 02 2a 00 02 80 08 8a 80 0a 80 00 00 00 00 00 00 00 00 00 a8 00 00 08 00 00 00 00 00 00 08 a8 00 00 00 20 Data Ascii: ( ( ( @t9Z%P@@E@EQ@svP@5PD* (" (( (
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 02 88 a1 a0 80 20 20 00 00 00 00 00 80 00 00 80 00 20 28 20 00 00 00 00 02 02 a0 a0 91 14 41 00 00 00 00 05 10 a0 a0 02 0a 02 00 0a 20 0a 00 00 00 00 28 8a a8 00 00 02 80 00 00 2a b9 01 d0 95 40 00 00 00 01 40 00 50 10 00 05 11 40 45 15 40 01 ff d7 da 40 61 d8 00 00 10 00 01 00 54 00 00 00 40 00 00 54 51 15 05 40 11 50 00 00 00 00 10 00 00 00 11 40 40 14 00 01 50 05 40 00 01 14 45 05 54 00 00 40 05 00 00 00 00 50 01 54 00 10 04 00 01 00 00 01 41 51 40 01 05 00 40 00 00 50 11 40 00 05 40 14 41 45 00 41 51 50 00 04 01 50 54 00 50 10 00 00 00 00 00 00 00 00 00 00 00 00 01 05 00 40 10 14 10 15 00 15 00 01 14 0a 20 00 00 00 20 00 00 00 00 00 00 00 02 88 20 1a 20 80 a0 02 00 02 80 08 80 00 00 00 00 08 22 88 22 80 00 00 82 2a 00 00 00 00 00 00 20 00 02 00 00 00 Data Ascii: ( A (@@P@E@@aT@TQ@P@@P@ET@PTAQ@@P@@AEAQPPTP@ ""
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 00 02 a2 80 00 00 00 00 a0 00 2a 00 a0 28 00 0a 22 80 00 80 02 80 00 00 28 00 ff d5 da 80 65 d0 00 51 15 28 20 00 00 80 00 00 00 00 00 00 09 40 45 41 40 50 41 40 40 10 00 00 05 04 54 00 00 00 00 00 00 00 01 00 00 14 00 00 00 00 00 00 50 00 01 41 00 04 00 00 00 00 00 00 00 00 05 14 45 00 04 40 05 00 00 54 50 00 00 00 00 00 00 01 44 00 00 01 00 00 00 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 11 40 40 00 00 00 04 00 00 14 00 10 43 4d 40 00 50 00 40 04 00 05 00 01 15 01 00 11 50 00 00 00 10 00 04 00 00 10 00 10 00 00 10 41 50 00 00 00 04 50 00 00 00 00 00 00 14 45 50 00 00 00 01 00 00 51 15 40 00 00 05 00 00 00 00 00 05 00 05 00 00 00 5c 45 50 05 11 00 14 05 04 15 00 50 07 ff d6 da 80 65 d0 00 07 2e 90 10 00 00 14 01 00 00 00 Data Ascii: *("(eQ( @EA@PA@@TPAE@TPD@@CM@P@PAPPEPQ@\EPPe.
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 08 8a 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 20 a8 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a2 00 20 00 02 28 00 00 88 ba 80 00 8a 00 20 00 0a 00 00 00 00 00 82 1a ba 80 8a 00 82 a0 00 00 00 00 00 8a 88 00 00 8a 02 0b 10 41 14 04 01 00 00 00 00 00 05 01 05 01 05 01 00 00 14 00 05 00 00 00 01 40 00 10 50 40 45 14 00 00 01 40 10 14 04 15 14 05 05 41 40 41 40 01 41 05 01 15 14 00 04 00 51 40 41 ff d4 da 80 46 80 01 00 00 00 00 00 01 40 00 00 11 15 00 00 00 00 00 00 00 10 10 54 01 44 01 44 01 44 01 44 00 00 00 00 00 00 14 00 40 00 00 00 01 50 00 00 00 00 00 00 00 00 00 00 00 01 55 00 51 00 14 00 01 40 00 00 40 50 10 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 00 00 00 01 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 00 00 Data Ascii: ( A@P@E@A@A@AQ@AF@TDDDD@PUQ@@PPQQ
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 0a 08 2a 28 00 02 a2 80 00 00 00 00 0a 00 82 80 80 a0 a0 28 00 00 28 3f ff d2 da 80 55 40 00 00 00 00 00 00 00 45 40 00 10 00 00 01 00 00 00 00 00 00 10 40 51 00 51 00 00 00 00 00 00 00 00 00 00 00 10 01 40 00 00 00 00 00 05 10 05 00 00 00 00 00 00 05 00 00 00 10 00 05 40 14 40 55 00 00 00 00 00 00 00 14 04 00 00 50 00 00 00 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 41 40 10 01 14 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 01 14 00 00 11 44 00 00 45 01 14 10 41 40 45 01 04 50 10 00 00 45 00 00 00 00 00 00 41 40 41 40 41 51 00 00 00 00 00 00 00 00 00 04 50 00 00 00 00 00 00 05 00 04 50 10 50 10 50 00 00 00 00 00 01 40 00 00 00 00 50 00 00 11 70 01 40 00 05 00 50 7f ff d3 da 80 51 00 00 00 00 00 00 04 50 10 00 10 05 10 05 10 00 00 00 00 00 11 Data Ascii: *(((?U@E@@QQ@@@UPA@DEA@EPEA@A@AQPPPP@Pp@PQP
2024-04-26 19:23:14 UTC	1369	IN	Data Raw: 02 00 00 00 00 00 00 8a 00 00 00 00 00 00 2a 28 80 08 00 00 00 a0 00 00 80 00 00 00 a0 00 00 00 8a 00 00 00 00 00 02 00 20 00 00 00 00 00 08 00 00 0a 8a 82 80 8a 00 00 08 a0 80 00 00 02 00 00 08 00 00 00 00 00 00 00 0a 22 80 22 80 80 00 00 00 00 00 00 00 a0 00 08 00 02 0a 8a 00 00 a8 a0 00 20 00 08 a0 a8 28 00 0a 80 00 00 00 28 08 a8 00 00 00 0a 0a 08 2a 28 00 00 00 ff d1 da 80 69 00 01 00 00 00 08 00 00 20 68 9a 00 0a 00 00 8a e4 00 00 14 04 04 00 00 00 00 54 50 01 10 00 00 14 10 40 00 00 00 00 50 00 00 00 00 00 00 14 10 01 00 01 54 45 00 00 00 01 51 40 00 00 00 00 05 00 51 14 50 04 00 00 00 00 00 00 00 54 01 40 14 00 00 00 00 00 00 10 00 00 04 50 00 00 00 00 01 44 00 00 04 00 00 00 50 00 00 40 00 00 50 00 00 01 40 10 00 00 00 00 10 00 00 10 00 00 00 05 Data Ascii: ( "" (((i hTP@PTEQ@QPT@PDP@P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49730	104.21.89.211	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:14 UTC	607	OUT	GET /favicon.ico HTTP/1.1 Host: onetw.wanglinfeng.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onetw.wanglinfeng.com/minetake/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:15 UTC	626	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 19:23:15 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a8f23a7e75a51b-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 19:23:15 UTC	322	IN	Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying t
2024-04-26 19:23:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49734	35.190.80.1	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:15 UTC	552	OUT	OPTIONS /report/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://onetw.wanglinfeng.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:16 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Fri, 26 Apr 2024 19:23:15 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49735	35.190.80.1	443	5156	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:16 UTC	488	OUT	POST /report/v4?s=Wy3P%2B3cnyD%2BQ6J2%2Fb6beA07x7AnwOy39eWmsjzDhRdOLfw8Dj7TF3Fy353TdzZTCgr6v6wl6T5P3UFSpSu7NEgwUeaRQ2T%2BgMuUhJ4HHgSJ7S3bZVcpmUPWX52uaHQMC8CS6T867sAg%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 441 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 19:23:16 UTC	441	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 32 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 74 77 2e 77 61 6e 67 6c 69 6e 66 65 6e 67 2e 63 6f 6d 2f 6d 69 6e 65 74 61 6b 65 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 38 39 2e 32 31 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b Data Ascii: [{"age":0,"body":{"elapsed_time":824,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://onetw.wanglinfeng.com/minetake/","sampling_fraction":1.0,"server_ip":"104.21.89.211","status_code":404,"type":"http.error"},"type":"network
2024-04-26 19:23:17 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 26 Apr 2024 19:23:17 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49736	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:44 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ORsMknvcz1PKnFR&MD=28FNTYEb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 19:23:45 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 38140026-52b1-4c18-8b97-f57c0548f13d MS-RequestId: 7aa946dd-03c6-40f0-a012-2e491f443119 MS-CV: LlTv+nAQPkWIVnKK.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 19:23:44 GMT Connection: close Content-Length: 25457
2024-04-26 19:23:45 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 19:23:45 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49739	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-26 19:23:58 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 19:23:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 19:22:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 35f1a623-340c-4978-be1d-2280ea017918 PPServer: PPV: 30 H: SN1PEPF0002F026 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 19:23:58 GMT Connection: close Content-Length: 11393
2024-04-26 19:23:59 UTC	11393	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.17	49740	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:59 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-04-26 19:23:59 UTC	438	IN	HTTP/1.1 200 OK Content-Length: 7285 Content-Type: application/json; charset=utf-8 ETag: -1392102344_1579286590 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: 26b364cb-4fd0-463a-8c4b-0cdcc36fb0ba X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 70A2562CA3C049E9AA58949510752384 Ref B: MIA301000104039 Ref C: 2024-04-26T19:23:59Z Date: Fri, 26 Apr 2024 19:23:58 GMT Connection: close
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 68 69 67 68 71 75 61 6c 69 74 79 63 61 70 74 75 72 65 63 22 2c 22 79 6f 61 6c 77 39 38 30 31 63 66 22 2c 22 79 6f 63 33 37 32 31 22 2c 22 61 61 74 65 73 31 32 31 22 2c 22 79 6f 63 61 6c 38 33 30 22 2c 22 65 6d 70 72 6f 37 30 32 22 2c 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 79 6f 79 70 70 31 31 37 22 2c 22 79 6f 79 70 70 35 36 31 22 2c 22 79 6f 70 68 6f 31 35 36 22 2c 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 79 6f 72 65 6d 37 38 32 22 2c 22 79 6f 72 65 6d 33 32 35 22 2c 22 79 6f 72 6f 6d 39 33 39 22 2c 22 79 6f 79 70 70 36 33 38 22 2c 22 79 6f 61 61 6f 77 63 34 36 63 66 22 2c 22 79 6f 35 35 36 22 2c 22 79 6f 61 61 6f 32 36 37 22 2c 22 79 6f 70 72 69 32 35 Data Ascii: {"Features":["highqualitycapturec","yoalw9801cf","yoc3721","aates121","yocal830","empro702","yonon248","contactsv2synconly","yoypp117","yoypp561","yopho156","ypromeless","yorem782","yorem325","yorom939","yoypp638","yoaaowc46cf","yo556","yoaao267","yopri25
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 2c 22 31 34 67 36 22 3a 22 61 61 74 65 73 31 32 31 22 2c 22 31 38 66 7a 22 3a 22 79 6f 63 61 6c 38 33 30 22 2c 22 31 68 6a 65 22 3a 22 65 6d 70 72 6f 37 30 32 22 2c 22 31 71 61 38 22 3a 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 31 77 6d 74 22 3a 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 32 69 77 6a 22 3a 22 79 6f 79 70 70 31 31 37 22 2c 22 32 6a 36 61 22 3a 22 79 6f 79 70 70 35 36 31 22 2c 22 32 6b 71 32 22 3a 22 79 6f 70 68 6f 31 35 36 22 2c 22 32 6c 61 64 22 3a 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 32 6f 63 64 22 3a 22 79 6f 72 65 6d 37 38 32 22 2c 22 32 72 65 6b 22 3a 22 79 6f 72 65 6d 33 32 35 22 2c 22 32 73 63 78 22 3a 22 79 6f 72 6f 6d 39 33 39 22 2c 22 32 74 70 33 22 3a 22 79 6f 79 70 70 36 33 38 22 2c 22 33 30 62 38 22 3a 22 Data Ascii: ,"14g6":"aates121","18fz":"yocal830","1hje":"empro702","1qa8":"yonon248","1wmt":"contactsv2synconly","2iwj":"yoypp117","2j6a":"yoypp561","2kq2":"yopho156","2lad":"ypromeless","2ocd":"yorem782","2rek":"yorem325","2scx":"yorom939","2tp3":"yoypp638","30b8":"
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 32 36 34 22 2c 22 35 39 30 71 22 3a 22 34 61 33 30 64 34 35 35 22 2c 22 35 39 67 67 22 3a 22 32 69 32 68 65 31 31 38 22 2c 22 35 39 67 6a 22 3a 22 34 64 65 35 67 35 34 32 22 2c 22 35 39 76 7a 22 3a 22 62 65 63 34 34 37 35 37 22 2c 22 35 61 39 73 22 3a 22 39 38 34 65 39 37 37 34 22 2c 22 35 61 74 6b 22 3a 22 35 35 35 64 37 39 37 38 22 2c 22 35 62 61 74 22 3a 22 65 6a 66 34 36 37 39 35 22 2c 22 35 63 70 66 22 3a 22 34 39 62 34 67 31 33 33 22 2c 22 35 63 72 73 22 3a 22 33 62 66 39 67 38 35 35 22 2c 22 35 64 77 37 22 3a 22 69 34 37 62 65 31 37 38 22 2c 22 35 65 74 36 22 3a 22 32 34 38 66 61 31 38 36 22 2c 22 35 66 6c 32 22 3a 22 68 35 31 66 30 33 34 32 22 2c 22 35 66 79 6f 22 3a 22 68 64 65 31 67 32 36 37 22 2c 22 35 66 79 71 22 3a 22 34 6a 6a 66 62 37 36 38 Data Ascii: 264","590q":"4a30d455","59gg":"2i2he118","59gj":"4de5g542","59vz":"bec44757","5a9s":"984e9774","5atk":"555d7978","5bat":"ejf46795","5cpf":"49b4g133","5crs":"3bf9g855","5dw7":"i47be178","5et6":"248fa186","5fl2":"h51f0342","5fyo":"hde1g267","5fyq":"4jjfb768
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 7d 7d 2c 7b 22 49 64 22 3a 22 59 6f 75 72 50 68 6f 6e 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 41 4f 57 43 34 36 22 3a 36 34 30 30 2c 22 41 41 4f 57 43 34 37 22 3a 37 34 30 30 2c 22 41 41 4f 57 43 36 31 22 3a 31 36 30 30 2c 22 41 41 4f 57 43 36 32 22 3a 32 36 30 30 2c 22 41 41 4f 57 43 36 33 22 3a 33 36 30 30 2c 22 41 69 72 70 6c 61 6e 65 4d 6f 64 65 53 74 61 74 75 73 22 3a 74 72 75 65 2c 22 41 75 74 6f 48 79 64 72 61 74 65 64 49 6d 61 67 65 73 43 6f 75 6e 74 22 3a 30 2c 22 43 61 6c 6c 69 6e 67 41 6c 74 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 45 76 65 6e 74 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 45 78 69 74 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 4f 53 53 65 72 76 69 63 69 6e 67 46 69 Data Ascii: }},{"Id":"YourPhone","Parameters":{"AAOWC46":6400,"AAOWC47":7400,"AAOWC61":1600,"AAOWC62":2600,"AAOWC63":3600,"AirplaneModeStatus":true,"AutoHydratedImagesCount":0,"CallingAltBluetoothPairingEvent":true,"CallingExitConfirmation":true,"CallingOSServicingFi
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 3a 74 72 75 65 2c 22 49 73 41 75 74 68 56 32 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4d 65 64 69 61 50 61 63 6b 43 68 65 63 6b 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 68 61 74 46 69 6c 74 65 72 54 6f 67 67 6c 65 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 73 65 6e 74 56 32 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 76 65 72 73 61 74 69 6f 6e 56 69 65 77 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 48 69 64 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 4d 75 74 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 50 69 6e 6e 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 Data Ascii: :true,"IsAuthV2Enabled":true,"MediaPackCheck":true,"MessagingChatFilterToggle":true,"MessagingConsentV2":true,"MessagingConversationView":true,"MessagingEnableHiding":true,"MessagingEnableMuting":true,"MessagingEnablePinning":true,"MessagingSearch":true,"
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 69 6e 67 54 6f 70 30 31 31 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 32 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 35 22 3a 74 72 75 65 2c 22 52 6f 6d 65 44 69 73 61 62 6c 65 64 22 3a 34 34 31 35 30 33 2c 22 53 65 63 75 72 65 43 6f 6e 74 65 6e 74 22 3a 74 72 75 65 2c 22 53 68 65 6c 6c 45 78 74 65 6e 64 65 64 4c 65 66 74 50 61 6e 65 22 3a 74 72 75 65 2c 22 54 65 73 74 46 65 61 74 75 72 65 32 22 3a 66 61 6c 73 65 2c 22 55 6e 69 76 65 72 73 61 6c 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 22 3a 74 72 75 65 2c 22 57 68 61 74 73 4e 65 77 43 4e 22 3a 74 72 75 65 2c 22 59 50 50 43 61 74 61 73 74 72 6f 70 68 69 63 45 72 72 6f 72 41 75 74 6f 52 65 73 65 74 22 3a 74 72 75 65 2c 22 59 50 50 43 6f 6e 73 65 63 75 74 69 76 Data Ascii: ingTop011":true,"RemotingTop012":true,"RemotingTop015":true,"RomeDisabled":441503,"SecureContent":true,"ShellExtendedLeftPane":true,"TestFeature2":false,"UniversalBluetoothPairing":true,"WhatsNewCN":true,"YPPCatastrophicErrorAutoReset":true,"YPPConsecutiv
2024-04-26 19:23:59 UTC	1024	IN	Data Raw: 79 6f 35 35 36 3a 33 30 39 38 36 35 35 36 3b 79 6f 61 61 6f 32 36 37 3a 33 30 34 33 34 36 37 32 3b 79 6f 70 72 69 32 35 37 3a 33 30 34 36 34 34 33 33 3b 79 6f 31 37 39 3a 33 30 34 34 35 33 31 30 3b 79 6f 69 73 61 38 36 31 3a 33 30 35 32 35 38 36 38 3b 79 6f 72 65 6d 31 34 31 3a 33 30 34 38 36 33 35 33 3b 79 6f 79 70 70 36 35 32 3a 33 30 35 31 35 34 38 33 3b 79 6f 35 32 35 3a 33 30 35 35 33 39 38 35 3b 79 6f 36 30 36 3a 33 30 35 32 37 38 35 30 3b 79 6f 6e 6f 74 36 33 33 3a 33 30 36 32 36 30 37 38 3b 79 6f 79 70 70 38 35 39 3a 33 30 36 38 37 38 35 39 3b 79 6f 69 6e 64 36 36 35 3a 33 30 35 39 35 31 36 33 3b 79 6f 64 63 67 38 33 30 3a 33 30 37 31 32 39 34 39 3b 6f 6e 6c 79 5f 74 6f 61 73 74 63 6f 6e 74 65 78 74 6d 65 6e 75 3a 33 30 36 34 38 30 38 31 3b 61 6a Data Ascii: yo556:30986556;yoaao267:30434672;yopri257:30464433;yo179:30445310;yoisa861:30525868;yorem141:30486353;yoypp652:30515483;yo525:30553985;yo606:30527850;yonot633:30626078;yoypp859:30687859;yoind665:30595163;yodcg830:30712949;only_toastcontextmenu:30648081;aj
2024-04-26 19:23:59 UTC	117	IN	Data Raw: 38 33 38 35 30 33 3b 35 30 63 37 39 31 30 36 3a 33 30 38 33 38 36 31 39 3b 6a 61 35 63 34 32 34 39 3a 33 31 30 30 36 32 34 34 3b 68 33 65 64 34 31 36 31 3a 33 30 38 39 31 37 38 34 3b 61 62 69 30 67 38 31 37 3a 33 30 39 35 32 38 37 35 3b 61 35 34 66 61 35 37 34 3a 33 30 39 39 33 33 34 39 3b 64 69 66 32 32 32 31 39 3a 33 30 39 36 30 34 30 32 3b 22 7d Data Ascii: 838503;50c79106:30838619;ja5c4249:31006244;h3ed4161:30891784;abi0g817:30952875;a54fa574:30993349;dif22219:30960402;"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49741	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:23:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-26 19:23:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 19:24:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 19:23:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 9e9ea414-5aa1-4ef4-ac06-74a6dae5eaf3 PPServer: PPV: 30 H: SN1PEPF0002F9FE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 19:23:59 GMT Connection: close Content-Length: 11373
2024-04-26 19:24:00 UTC	11373	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49742	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:24:00 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-26 19:24:00 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 19:24:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 19:23:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 3c03797e-0871-4182-b521-09ca1aabf1fb PPServer: PPV: 30 H: SN1PEPF0002FABD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 19:24:00 GMT Connection: close Content-Length: 11373
2024-04-26 19:24:01 UTC	11373	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49743	40.126.28.13	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:24:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-26 19:24:01 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 19:24:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 19:23:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 1ea791dc-27f3-46e0-8d27-eaf2cdd09772 PPServer: PPV: 30 H: SN1PEPF0002F1AF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 19:24:01 GMT Connection: close Content-Length: 11177
2024-04-26 19:24:01 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49744	23.219.0.141	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 19:24:02 UTC	2590	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDgAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAa6NsFTHCx%2B0lXq2gX96BskxGBoRUAfbDg3RpSwgDvA3/zVlAGmY3lwAp0%2B9CEF1xo1rWNe8wKFDQeprNYilCg5WUwRRhO6yy3qeh13Xg/c1kqvThhTjvGOKN39BZkTZwJ9cmUc8k%2BUUwDy2qHFCMhgYldO96lnrOYt96KP5rnq2kES5dKTMz5ogTfrRlWR5Ry9ZmF0Of%2Ba75SzOuFsVl6az2oAaX5X1WAIl0HAxl16jEJlQDsnbEmXpiw%2BEhrnPbZpkJPhRB4kt65TlpbSFLfHnMMIrap3rkCr/Y%2Brhs8hYdyPHGQvdpt5MHYZlBHLx2L60nGxBs37pDSUSP7A7ICcDZgAACGU9KW%2BOZysssAGBPGp4TJtTZQu/Sd3cbolgX%2Bm%2B9Ju0r3y%2BfX%2BtCA0ELA%2Bs%2Bz/jFW08APVraBLvRsWeJEKZoVZktgHjb1XUIj3xZsfURXdtMY%2BJFp9XBEj2x/U9tNReJyRWnt2zdJmiYk0xB2frK/GYv4%2BNiqnr3hx5tTfdc87iiahVL7dLAlxD4QBXiD/q3aumPn6Gok0wIxpR2G6qj67Hu0jMP7FbTryiPrmWD0WRhq9cmezhfG5i9yAIPggtdNvBjFk0NsAEHqqvvv6ZvgycQwtH6lEB5U7P41Ke6LsU5sujdwDJHwb4drYJeQVSp0RshrgOoQWEuf2bUybbqIQl442QcKprzLwzQGIggNX5i/Gie6mfA8s/gPs9mc2NFLZ3RgFs9oqDGfAj5WnQicEEPtGpR14JWEGtuZHWZd3ud/0yH1zG/3eAVGFHUjBi8pzVZ4jF3Uyy9x2A6R9DAHwDnDljPvoTC1Xgl9hUX8TckeNQMDGlNY6Q5p7z%2BlHLq%2BW/yQKg4YRDdu/wBFLJooD23V03WjHw9fFn9VpLQyseBpjI9wXKe/ngL9S3UZsEHcF [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1714159436 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 0FEDE8C12CB640A9AE5E8FFEDDD74431 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-04-26 19:24:02 UTC	1147	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 662bff52d2374d5e889ff19baf85535e X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Apr 2024 19:24:02 GMT Connection: close Set-Cookie: _EDGE_S=SID=048F15E3B7546ED11B11018EB6426FFA&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Wed, 21-May-2025 19:24:02 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=048F15E3B7546ED11B11018EB6426FFA; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.0dfbda17.1714159442.2d74634
2024-04-26 19:24:02 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6100, Parent PID: 4704

General

Target ID:	0
Start time:	21:22:50
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5156, Parent PID: 6100

General

Target ID:	1
Start time:	21:22:51
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1960,i,14208868564962595604,3052524558064138358,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly