Edit tour

Windows Analysis Report
http://im20.net/

Overview

General Information

Sample URL:	http://im20.net/
Analysis ID:	1493583
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2044,i,15425770461339576517,7441177578250678950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://im20.net/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /report/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 406Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 15 Aug 2024 22:20:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b3c926f8941429a-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_77.2.dr	String found in binary or memory: http://im142.mom/generate-qrcode
Source: chromecache_81.2.dr	String found in binary or memory: https://im142.mom/
Source: chromecache_79.2.dr	String found in binary or memory: https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56218
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@19/53@20/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2044,i,15425770461339576517,7441177578250678950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://im20.net/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2044,i,15425770461339576517,7441177578250678950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://im20.net/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://im142.mom/images/menu.png	0%	Avira URL Cloud	safe
https://im142.mom/images/banner.png	0%	Avira URL Cloud	safe
https://im142.mom/images/apk-zh.png	0%	Avira URL Cloud	safe
https://im142.mom/images/alarm.png	0%	Avira URL Cloud	safe
https://im142.mom/favicon.ico	0%	Avira URL Cloud	safe
https://im142.mom/images/bdTokenLogo.png	0%	Avira URL Cloud	safe
https://im142.mom/images/ewm_icon.png	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D	0%	Avira URL Cloud	safe
https://im142.mom/images/bdapk.png	0%	Avira URL Cloud	safe
https://im142.mom/generate-qrcode	0%	Avira URL Cloud	safe
http://im142.mom/generate-qrcode	0%	Avira URL Cloud	safe
https://im142.mom/images/ccc8.css	0%	Avira URL Cloud	safe
https://im20.net/favicon.ico	100%	Avira URL Cloud	phishing
https://im142.mom/images/bdpg.png	0%	Avira URL Cloud	safe
https://im142.mom/images/google-play.png	0%	Avira URL Cloud	safe
https://im142.mom/images/111f.css	0%	Avira URL Cloud	safe
https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js	0%	Avira URL Cloud	safe
https://im142.mom/images/swiper.min.css	0%	Avira URL Cloud	safe
https://im142.mom/images/app-store.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
eu-central-1.oss-acc.aliyuncs.com	47.254.187.65	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
im20.net	188.114.96.3	true	false	unknown
im142.mom	8.218.143.165	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
tretwq.oss-accelerate.aliyuncs.com	unknown	unknown	false	unknown
56.126.166.20.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://im142.mom/favicon.ico	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/apk-zh.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/bdTokenLogo.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/ewm_icon.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/banner.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/menu.png	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D	false	Avira URL Cloud: safe	unknown
https://im142.mom/download.html	false		unknown
https://im142.mom/images/alarm.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/generate-qrcode	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/bdapk.png	false	Avira URL Cloud: safe	unknown
https://im20.net/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://im142.mom/images/bdpg.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/ccc8.css	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/111f.css	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/swiper.min.css	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/google-play.png	false	Avira URL Cloud: safe	unknown
https://im142.mom/	false		unknown
https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js	false	Avira URL Cloud: safe	unknown
https://im142.mom/images/app-store.png	false	Avira URL Cloud: safe	unknown
https://im20.net/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://im142.mom/generate-qrcode	chromecache_77.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
8.218.143.165	im142.mom	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.254.187.65	eu-central-1.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	im20.net	European Union	13335	CLOUDFLARENETUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1493583
Start date and time:	2024-08-16 00:19:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://im20.net/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@19/53@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://im142.mom/download.html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 142.250.185.142, 142.251.179.84, 34.104.35.123, 13.85.23.86, 199.232.210.172, 20.242.39.171, 192.229.221.95, 20.3.187.198, 20.166.126.56, 52.165.165.26, 131.107.255.255, 20.114.59.183, 142.250.184.227, 216.58.206.78
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://im20.net/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	46217
Entropy (8bit):	7.964374741757792
Encrypted:	false
SSDEEP:	768:syGVt5SSk+GII7jfi0LOURWhIozDk1RCf9ytwVVuEosk7JAl30TVcEHhISVOL:syCkLpjfV26+Dk7W9Qwvu1s4JYkTVcqS
MD5:	2DB0958F039A4F4E27989DFAE2DB6C4B
SHA1:	B47948C1F52C4DDDB810CDF79BE4671CAAE95E13
SHA-256:	55BA14C1276411D66A855994595FF557C06BA879CB7861059D777F070CD82281
SHA-512:	94BF6634A5F2CC9C1545B8A25E3EA8E2FAF978642B2CAC18BDCDB354B0CCB7A2B6420958DD6721F52D403961A4E18B41DF7F9BE72FD4EBC5AD73EC2B7FA35E5E
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/banner.png
Preview:	.PNG........IHDR.............z}$.....PLTE.............................................G@j02FB.g....f.ia<.........................9..c................lf.U..Y[kh....+........CEO}}}Y.^.~..}J........c].OQb.y................................1...`..'u.........&.{......NPW}..............................{}.FHR...IKT..........Qj......UW`....._ai........QS\..........Z\e............rtz.....B...............#..mntghp...............................l..T..'..........P.s.....o+-/...wz....1..u.......SMt'(Edel.....P...~..<?SD..wx.ZV\|...=?@IK]...K........... $?.\|u.tm9..}......^`a25747L[........7...............L.........V........M..H..........d..9....1..\|...ohX.....)..k....BCER...uv.H....Ngm...:S]...hi.ju.........]l.A.....o.....us.=....%.zbevr.U..H..ix..Xp..._...cyA..O..g..........tRNS.`.!y.@...1.Z.....IDATx...N.@...!..9+..c$.p...@..P.U Q.}.(..[^....x..Sgvw..q..%$.......-....h.....O.,+....e{..v.0....."qh..i...[.v.....+.....w....O>.....D....\|h....Q)LF..

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.018332904023515
Encrypted:	false
SSDEEP:	96:H4YBxu3kR73CqtPgkiXeDQdanhKtTPvAXWXo77bbtxJgQXOxqEmKebm9iL96sL9I:HLDu3kR73CqtPEeThkPvAmG73XezG6EN
MD5:	34A9FB0A16D64BDD02217B9F558FC68E
SHA1:	5A586E8196D82D5167BC904FACD53FFD11829F93
SHA-256:	982543E85193587F09B7A0F6945BDFAF80571CC4E98F859AEF494C54E07BEA33
SHA-512:	9A61AEF4CDF81D8748083985441C7C2B391AF78FF78B1ACDC2BF0E1EAFFAC9D5D4FDAF133302B5237293B8946BF0477FBA4F2125F06C297555CAED86DC3A8B33
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... ..........................i.......i...j.A.k...l...n..o..p...r...s...u...w...x...z...{...}..............................................@.............^...i...j.W.j...k..m..o...p...r...s...u...v...x...z...{...}...~.................................................T.....z...i...j.Y.j..k...m...o...p...r...s...u...w...x...z...{...}...~.............................................................S.....j.C.j...k...m...o...p...r...s...u...w...x...z...{...}...~....................................................................>.k...l..m...o...p...r...s...u...w...x...z...{...}...~..........................................................................l...m..o...p...r...s...u...v...x...z...{...}...~.............................................................................n..o...p...r...s...u...w...x...z...{...}...~...............................................................................o..p...r...s...u...w...x...z...{...\|...~

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	6.018332904023515
Encrypted:	false
SSDEEP:	96:H4YBxu3kR73CqtPgkiXeDQdanhKtTPvAXWXo77bbtxJgQXOxqEmKebm9iL96sL9I:HLDu3kR73CqtPEeThkPvAmG73XezG6EN
MD5:	34A9FB0A16D64BDD02217B9F558FC68E
SHA1:	5A586E8196D82D5167BC904FACD53FFD11829F93
SHA-256:	982543E85193587F09B7A0F6945BDFAF80571CC4E98F859AEF494C54E07BEA33
SHA-512:	9A61AEF4CDF81D8748083985441C7C2B391AF78FF78B1ACDC2BF0E1EAFFAC9D5D4FDAF133302B5237293B8946BF0477FBA4F2125F06C297555CAED86DC3A8B33
Malicious:	false
Reputation:	low
URL:	https://im142.mom/favicon.ico
Preview:	...... .... .........(... ...@..... ..........................i.......i...j.A.k...l...n..o..p...r...s...u...w...x...z...{...}..............................................@.............^...i...j.W.j...k..m..o...p...r...s...u...v...x...z...{...}...~.................................................T.....z...i...j.Y.j..k...m...o...p...r...s...u...w...x...z...{...}...~.............................................................S.....j.C.j...k...m...o...p...r...s...u...w...x...z...{...}...~....................................................................>.k...l..m...o...p...r...s...u...w...x...z...{...}...~..........................................................................l...m..o...p...r...s...u...v...x...z...{...}...~.............................................................................n..o...p...r...s...u...w...x...z...{...}...~...............................................................................o..p...r...s...u...w...x...z...{...\|...~

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	7.903912267292875
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BTn:zGI/zRw6cF1Vrlqvvi4vDb6BTn
MD5:	F76E522018AA9D6436D39B91EF04B290
SHA1:	00D8A54593237D6A938E423C5B229C14133DAB9A
SHA-256:	A9799128F052DF069AA0A177D63246F613AEFECF836AADD8376ED1353D176AE4
SHA-512:	BA4FD33794EB41ACED1B0658392EB0E0AAE50690AECAAE2BEE1C986C3BB5B284D7C3657EC2780DE1112CA6F54C0620C59178EC007F7E66A08E6E58AC4BFCAB83
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	7.876511700197984
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQZ:Js6pKqAtOJ2QMwDADPWQZ
MD5:	ABF31B76D59677788337BDFCD9A34391
SHA1:	767403D4EBBCF2D1956BDB5CA78CD7BD84356CA2
SHA-256:	AA4B6739129D850F473455B4F4E16FC265CA65588830C05EEAF0E00B7DFC5629
SHA-512:	7FB19CAEF811136CE9AB5B6B50A0BFDE31ECB1D5188E93B2CFBC87F40CBC7A76B93BA6BDF22C05DB9590CCB7FB0C4558C7D44303858C24423F69EBCF5E3D254F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5698), with CRLF line terminators
Category:	downloaded
Size (bytes):	80757
Entropy (8bit):	5.005792842230702
Encrypted:	false
SSDEEP:	768:gbKMmczw0lPtuGZjzlL2PzW2NbMUx/3YmGNQscx:EKVcMStuGZjgzBCW/oJWJ
MD5:	847C0664353B3F30CFA9C440DD70C41C
SHA1:	9B27954A58DA023D2FDAB00B08DB31E363EF737D
SHA-256:	CB33021EFD71A3A62082C7AECCE8EA046B48BD1A96044A3FFDCECE1212F3BFE4
SHA-512:	9A2A10D86FBC8534C293E639FF50F6D3BC4256D349CB0785FBF42873D51F470196FBB42E6620287EF00F201C55E95AD7C41FA341A91171133F37FC00DF7F4C48
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/ccc8.css
Preview:	.ant-card{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0;color:rgba(0,0,0,0.65);font-size:14px;font-variant:tabular-nums;line-height:1.5;list-style:none;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum';position:relative;background:#fff;border-radius:2px;-webkit-transition:all .3s;transition:all .3s}.ant-card-hoverable{cursor:pointer}.ant-card-hoverable:hover{border-color:rgba(0,0,0,0.09);-webkit-box-shadow:0 2px 8px rgba(0,0,0,0.09);box-shadow:0 2px 8px rgba(0,0,0,0.09)}.ant-card-bordered{border:1px solid #e8e8e8}.ant-card-head{min-height:48px;margin-bottom:-1px;padding:0 24px;color:rgba(0,0,0,0.85);font-weight:500;font-size:16px;background:transparent;border-bottom:1px solid #e8e8e8;border-radius:2px 2px 0 0;zoom:1}.ant-card-head::before,.ant-card-head::after{display:table;content:''}.ant-card-head::after{clear:both}.ant-card-head-wrapper{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-i

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	212694
Entropy (8bit):	4.991735685882411
Encrypted:	false
SSDEEP:	1536:dZRfkfXfkfuf+fyf+fTXGEvvkWvhIOXCHuNrAve:VfkfXfkfuf+fyf+f7JveOX0ve
MD5:	7BD86F4726D78529DD520F1CD3AE2A0D
SHA1:	32A66D6B2ACEE9BADE71A8A46B575A156ED1BE30
SHA-256:	1CD09ED3AF41260ED24CFB48476570D1EE268B8F15747ED328B8DAD9A8579A2D
SHA-512:	69DDA6CAEED44F8B05FC884AD9CB518EB3286385B14031245CE1FA2AE322D83317F54FAAD060CAABF7286291401873932FDA97D8A93C0AF391F6D534B8A5DEF7
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/111f.css
Preview:	body,html{width:100%;height:100%}input::-ms-clear,input::-ms-reveal{display:none}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;-ms-overflow-style:scrollbar;-webkit-tap-highlight-color:transparent}@-ms-viewport{width:device-width}article,aside,dialog,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;color:rgba(0,0,0,.65);font-size:14px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Hiragino Sans GB','Microsoft YaHei','Helvetica Neue',Helvetica,Arial,sans-serif,'Apple Color Emoji','Segoe UI Emoji','Segoe UI Symbol';font-variant:tabular-nums;line-height:1.5;background-color:#fff;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum'}[tabindex='-1']:focus{outline:0!important}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bott

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	574
Entropy (8bit):	6.569526339310239
Encrypted:	false
SSDEEP:	12:6v/7gpf14mA79b5+RySTceTkBC0OFok64VCDBHhjOuD1TtERCOoZpcdQ:rAxMRiMkOFossdHJDcRbecS
MD5:	36CDC225A4AFF886460958BFA68D8652
SHA1:	62A0109C80A3AB12F4860979C82EED0E68C0B6DC
SHA-256:	F47BA776D98F3D983540033B771040BA35BA7EFA776687088526A5F0FB7FEE10
SHA-512:	407F2B122C06F59A8E7C2902D58593DDE2DEEC03AE4E7BFC138B9DED21A888A6D1A157907024CF3757682AF1450A315BD7FD41833658A1C20E0792A0CF844788
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/alarm.png
Preview:	.PNG........IHDR....................PLTE.................................................................................................................................................................................................................2....CtRNS............. <=IOPQ\]^_efgklwx{\|}~..................................g....bKGDD........IDAT(.c`.+.....(....Z....8.8...1T.A.....oa.....bF.u........&..H..A.($b..$..2. .H............c0Y..I.e...]5 ...)...]..J.H.aX.o...\.. %.`...9.. ...c..E[...(FT........b..i....IEND.B`.[[AT*]26CAAE04C3C041978E4166C5202FE945

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 26, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	198
Entropy (8bit):	5.693458436190708
Encrypted:	false
SSDEEP:	6:6v/lhP4MiAmZoENWt2M2jdSIxltjQIf3VcUI:6v/7gMiFZo/TIxltsIf3VcUI
MD5:	854BD90BD4CF76A1AF5782725CD2886C
SHA1:	C4DE2334A96441AF7C86BEF212DFA7E4BFFB663D
SHA-256:	A5874AFD125A4191ECD5EFDEBFEF064965B240CAB4C132F1197C464545BCFEB7
SHA-512:	9387790A4655DDFD9FB7D9EB2433977ABFD9FB28CDABC6AA2A0AF3606D76EDE4E5AC43DB449F38F049578EFB94C233DA95A182C2B9E13EA80281E880535EFC5C
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/menu.png
Preview:	.PNG........IHDR.............[dQ.....PLTE...6;N6=L6<M6<M6<M6<M.....l....tRNS.luw...ls.....bKGD..a.....#IDAT..c`..`M......Fc....\`@.F.Q.G..?.9.......IEND.B`.[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1068), with CRLF line terminators
Category:	downloaded
Size (bytes):	5913
Entropy (8bit):	4.989836697680563
Encrypted:	false
SSDEEP:	96:JIaiTuL47r7Ne7z9Sqiu3eaEGtD1rf3oaylynKmahKKfc0YOg:JIaiTuk7Ne7UqiUeaEaTnzahpgp
MD5:	6C1AF40FC33373FBCDDAF9B665871286
SHA1:	9B76CF5CD499068C90DBFDB8C1A9AF8E497983A1
SHA-256:	4A0F58974236BF6BCE3D18F819112B27E391CFB162F6C0C48BD1C9DE8BFF5D74
SHA-512:	162C2FB53529A31208D91D9AD1F2CFF919DBC3C22269BEF60C590F21F0A07A0351126041D9C06C180D5DBBA1548B2FBDACCD17E050104A2950505A24BD817562
Malicious:	false
Reputation:	low
URL:	https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js
Preview:	function isSpider() {.. var flag = false;.. var spider = navigator.userAgent.toLowerCase();.. var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot'];.. for (let i = 0, len = spiderSite.length; i < len; i++) {.. if (spider.indexOf(spiderSite[i]) > 0) {.. flag = true;.. break;.. }.. }.. if (!flag) {.. goPAGE();.. }..}........function goPAGE() {.. if ((navigator.userAgent.match(/(phone\|pad\|pod\|iPhone\|iPod\|ios\|iPad\|Android\|Mobile\|BlackBerry\|IEMobile\|MQQBrowser\|JUC\|Fennec\|wOSBrowser\|BrowserNG\|WebOS\|Symbian\|Windows Phone)/i))) {.. // var ss = '<center id="yangchen" style="position:relative;top: 0;bottom: 0;left: 0;right: 0;z-index: 99999999999999"><iframe id="external-frame" scrolling="no" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="800px" src="https://im142.mom/" ></iframe></center>';.. // document.body.insertA

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 18, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2134
Entropy (8bit):	7.8735863405323565
Encrypted:	false
SSDEEP:	48:erg0Xsq4sp5oKqdo1NB3tyigRDZbmmEGRWVmAG:e80cq4spDqSF3tyvmmEGs0P
MD5:	41380BECBE34B9A14002D3004CECEEA0
SHA1:	B48DAF96C312451ABECAFE45E05A8B375AF4D128
SHA-256:	6E31F3B32464FD3CC011B31AD7E933CDDF192D949995E1F7721BD8E15073BB85
SHA-512:	8E6320FFBBB86FFF84F154DA6A8840B71DDE6570C888F8DECFC72403769F7CECF8C6971D28A2C72E39DE580CB44EC5FADE7A93530CBC8FB2A9285496C3F2F42D
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/bdTokenLogo.png
Preview:	.PNG........IHDR...m.........Q.PB....bKGD..............IDATX..yLTG..W.\|.x.j.c=.@4.......51....^.(.x.E.R...[.......(J.m..V..H..N..o...}....M\|.dwg.....o~.Y..q=^....l...d..f)...r..-{.<}..Ye7:.l3.j...j......2..G....apD..X.O.}#.O.\|-....V6.l..;.4I.j..}.4..V...Y.f...q...D.........d.=...H..T..<.....`.6...6......1.h..k/.d.1.mj...w/u/..w....E.^DmF......i.K..22....CU..........jd.<.xp5....."...A...H.Xm.c>&;.b.1.B...D..e..{.....F....o.n...}E.z.R...../..........SHw..J.?...W#}&...x9..Uw.....p......D..)..8:....j.{.zM.R%.LhT.g$%..............+.. .;..208H'...F........=$..0Y.....W..d.....Y....f+..,&FA.u.s..m.&;=.d..&.K{....p.pV..z.&...bg..d...B..M...1...3...gA...Y..;...;..y`t.q.k.+0...t.L.R..}...rW.j.......uEq....I..U....^..vW...)G.}..S]%.e.<.....sj.4...BX.y..G...1...,J...5..lR......,..eW.;.p....{k.....-.h..o;;..w.!.%...X....C.3.....3WY.$..jY~.,....R..iR..4.<.Tj.x..R{.R....N.......*..K.......F...,.v...a.>...IC.......]~.,..`....t%......

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 26, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.693458436190708
Encrypted:	false
SSDEEP:	6:6v/lhP4MiAmZoENWt2M2jdSIxltjQIf3VcUI:6v/7gMiFZo/TIxltsIf3VcUI
MD5:	854BD90BD4CF76A1AF5782725CD2886C
SHA1:	C4DE2334A96441AF7C86BEF212DFA7E4BFFB663D
SHA-256:	A5874AFD125A4191ECD5EFDEBFEF064965B240CAB4C132F1197C464545BCFEB7
SHA-512:	9387790A4655DDFD9FB7D9EB2433977ABFD9FB28CDABC6AA2A0AF3606D76EDE4E5AC43DB449F38F049578EFB94C233DA95A182C2B9E13EA80281E880535EFC5C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............[dQ.....PLTE...6;N6=L6<M6<M6<M6<M.....l....tRNS.luw...ls.....bKGD..a.....#IDAT..c`..`M......Fc....\`@.F.Q.G..?.9.......IEND.B`.[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	6.569526339310239
Encrypted:	false
SSDEEP:	12:6v/7gpf14mA79b5+RySTceTkBC0OFok64VCDBHhjOuD1TtERCOoZpcdQ:rAxMRiMkOFossdHJDcRbecS
MD5:	36CDC225A4AFF886460958BFA68D8652
SHA1:	62A0109C80A3AB12F4860979C82EED0E68C0B6DC
SHA-256:	F47BA776D98F3D983540033B771040BA35BA7EFA776687088526A5F0FB7FEE10
SHA-512:	407F2B122C06F59A8E7C2902D58593DDE2DEEC03AE4E7BFC138B9DED21A888A6D1A157907024CF3757682AF1450A315BD7FD41833658A1C20E0792A0CF844788
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................PLTE.................................................................................................................................................................................................................2....CtRNS............. <=IOPQ\]^_efgklwx{\|}~..................................g....bKGDD........IDAT(.c`.+.....(....Z....8.8...1T.A.....oa.....bF.u........&..H..A.($b..$..2. .H............c0Y..I.e...]5 ...)...]..J.H.aX.o...\.. %.`...9.. ...c..E[...(FT........b..i....IEND.B`.[[AT*]26CAAE04C3C041978E4166C5202FE945

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2668
Entropy (8bit):	7.903912267292875
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BTn:zGI/zRw6cF1Vrlqvvi4vDb6BTn
MD5:	F76E522018AA9D6436D39B91EF04B290
SHA1:	00D8A54593237D6A938E423C5B229C14133DAB9A
SHA-256:	A9799128F052DF069AA0A177D63246F613AEFECF836AADD8376ED1353D176AE4
SHA-512:	BA4FD33794EB41ACED1B0658392EB0E0AAE50690AECAAE2BEE1C986C3BB5B284D7C3657EC2780DE1112CA6F54C0620C59178EC007F7E66A08E6E58AC4BFCAB83
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/bdapk.png
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2668
Entropy (8bit):	7.904166148327056
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BLM:zGI/zRw6cF1Vrlqvvi4vDb6BI
MD5:	F7F6F072A08711A5CB57416F48367E97
SHA1:	EAB18CE8D5B23318146743BFD20ADCDC1944BB3B
SHA-256:	75F1A696EE883ABD5753ACCF01BB029E517A23D5B7E53A0032A767F8B309DD24
SHA-512:	D7341FB3F568D84DFAF0D03A7306C92A99DAFA9EFC86B25FAEB3F5C9AB34B001D7672D0587BA91E11516AD227FC0EEDDF806FE9CF2DA609F8563929E503320C8
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/apk-zh.png
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	1774
Entropy (8bit):	7.876511700197984
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQZ:Js6pKqAtOJ2QMwDADPWQZ
MD5:	ABF31B76D59677788337BDFCD9A34391
SHA1:	767403D4EBBCF2D1956BDB5CA78CD7BD84356CA2
SHA-256:	AA4B6739129D850F473455B4F4E16FC265CA65588830C05EEAF0E00B7DFC5629
SHA-512:	7FB19CAEF811136CE9AB5B6B50A0BFDE31ECB1D5188E93B2CFBC87F40CBC7A76B93BA6BDF22C05DB9590CCB7FB0C4558C7D44303858C24423F69EBCF5E3D254F
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/app-store.png
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5040
Entropy (8bit):	7.868504612615864
Encrypted:	false
SSDEEP:	96:mgt5j4Yse4YZeEl+EReUhMc1siEdGf+RqGg5o4vDwwlDS7yJaqq:mgt5cY9l+Skc1Sdk6Y5pzAyJaqq
MD5:	849CEC98528DE42117275D99C1F80D41
SHA1:	3D7AD67466F411630503CAC12712BC07411C817A
SHA-256:	49C2086BCCE87CBEF4B50F83F7B647691360EABF9824686E82A0D3607ADEA486
SHA-512:	CAB03A81D1CBE1A2E002A979DA449F7580CD9BDA979CDD5C679BBDCBF2FF2D54F9B09D9EC333F4F958A186B0CA3C4DE285A3B9312712BC28C98B6A77B5B3FE0B
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/ewm_icon.png
Preview:	.PNG........IHDR..............X.....PIDATx^.]r....O...}....T....<X........ f.8+.......`.....&.S.y.1oh....(.bk...z..T.R...............P...@.......(P...A....m...)....b....dM..j.).@.tC.5Q.....QM7....n..&...514....q....D......a....V.X&........J....A....n....(.6b/..\|J..uUN...qz"...&( ..f....".-.Bu(...J.71..e.~d.]E.KD.:..KQ/..X..}.....@.;.....FY..ES0..c>Vw..2..?^...i.....x.../..eQ..B...H..^.k..V.hR.{..$.....D..k.%.hP...$.\.......{....H....W....i.....?.R...P..<..y...s.....q..;.X.._..;MBR..=....0..<....5 ..J.. ..r;.@b.H..~#".:.O..`R.;!.$.C{.U_..),.......KI..0V.d.}b..]\|v.....S.(...<..k.R.,c...v.+..2....[E4.$Y.......[........$..........4_":.{5S;.3...m.,.%D[\|m....e>...........0..(.C.+l.V.J.}.(........9..X.lKO.\|67.x.\.......g.Q....._....g...........Fo....u...~...U..I.."z&hWoGy_<......]E.'...1.C......8N_.....t.g....).dR...v.R@.t*:...+s(......Q..h...?=.V.z.X.I........T.j..MG..$K{.0.'A}..1.nS&.q...p..z.,....>..+a%...#.y_tnP....:....8J...$..v.8+

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 1-bit grayscale, non-interlaced
Category:	downloaded
Size (bytes):	396
Entropy (8bit):	6.981553520735627
Encrypted:	false
SSDEEP:	12:6v/7SnUXCNRm6fhlfgtFQ//ATPQAe4ABr:bcX6fhlItFWYDgXr
MD5:	C544EE9FCE488812B097FCB37E7C7775
SHA1:	C4192FFA5D688825461B974283DF0B3E77B21BC0
SHA-256:	9A44F93923160FDC638590B474AA98C281B491A6DF7D6D81FE72348526F64F02
SHA-512:	A6A3B5D862D6EB2CA50987AA2ACDF51BE3AAB0F0878D8F422947C5F4EDC68576E6465DA7F5EA11A358C22C03FA83D14C5A9BBF82A382847593EB989B3EEA4B98
Malicious:	false
Reputation:	low
URL:	https://im142.mom/generate-qrcode
Preview:	.PNG........IHDR..............#.3... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..[.. .E.9K...^$..:i:z.N.....&...zQ.c.~'.7>..Jsb...%..A$.R...n.y.G........tz;...8.E)&.B].C\|h...{..3v.W.$T\|..b.d.....iLrJ.G.TKW>.A$.....7...7........sHRn.7+. p.BkR...D.r.Z.L..7.BiW.\|q...$......2.P).".[s....;Y ,i.$w/.z........\.......S..m.$rW._...\sc..3......Bw.3......".......IEND.B`.

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19551)
Category:	downloaded
Size (bytes):	19552
Entropy (8bit):	5.1359623253769735
Encrypted:	false
SSDEEP:	192:TaNv/lSSyJWCh8zfi5o/mXDN3eBxwdJ5i:Ta1/lS0Cifi5o/mXOGJ5i
MD5:	403DF3ADE63891E44CF4514426E7F197
SHA1:	17B3903BADB3290C560483E84A65DCD45E133E78
SHA-256:	3185104DEDC54155FB4F6FD3BDDCC9894293F9854C1E3C6CF7033D6C0D58BDFB
SHA-512:	B00F1A1F06D1B5FF1CFFB6EAC8F5129B693741022E07FBFE0B4BB246BF2442A05B847448BA5EAB29661BE2B52A2816E8768B1CFEF8E8B40548A9D033F1411CE5
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/swiper.min.css
Preview:	. .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column}.swiper-wrapper{position:relative;width:100%;height:100%;z-index:1;display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-transition-property:-webkit-transform;transition-property:-webkit-transform;-o-transition-property:transform;transition-property:transform;transition-property:transform,-webkit-transform;-webkit-box-sizing:content-box;box-sizing:content-box}.swiper-container-android .swiper-slide,.swiper-wrapper{-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}.swiper-container-multirow>.swiper-wrapper{-webkit-flex-wrap:wrap;-ms-flex-wrap:wrap;flex-wrap:wrap}.swiper-container-free-mode>.swiper-wrapper{-webkit-

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 1-bit grayscale, non-interlaced
Category:	dropped
Size (bytes):	396
Entropy (8bit):	6.981553520735627
Encrypted:	false
SSDEEP:	12:6v/7SnUXCNRm6fhlfgtFQ//ATPQAe4ABr:bcX6fhlItFWYDgXr
MD5:	C544EE9FCE488812B097FCB37E7C7775
SHA1:	C4192FFA5D688825461B974283DF0B3E77B21BC0
SHA-256:	9A44F93923160FDC638590B474AA98C281B491A6DF7D6D81FE72348526F64F02
SHA-512:	A6A3B5D862D6EB2CA50987AA2ACDF51BE3AAB0F0878D8F422947C5F4EDC68576E6465DA7F5EA11A358C22C03FA83D14C5A9BBF82A382847593EB989B3EEA4B98
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............#.3... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..[.. .E.9K...^$..:i:z.N.....&...zQ.c.~'.7>..Jsb...%..A$.R...n.y.G........tz;...8.E)&.B].C\|h...{..3v.W.$T\|..b.d.....iLrJ.G.TKW>.A$.....7...7........sHRn.7+. p.BkR...D.r.Z.L..7.BiW.\|q...$......2.P).".[s....;Y ,i.$w/.z........\.......S..m.$rW._...\sc..3......Bw.3......".......IEND.B`.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	7.876307166249649
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQMG:Js6pKqAtOJ2QMwDADPWQp
MD5:	C6F28C3D1DAECC73810F2CD1BEC84BA4
SHA1:	58CC19E0C26BD41CCA24760F6932B87185C888E2
SHA-256:	5AC65915AAF2293E7CD843D07C2ED595658E90EBD51002777F03ED8E52BDBA9C
SHA-512:	BBA74C5541CD0011C4DEFB7A056AA10CE5DB067ABCA7BEE837B96E894D9C3AB248736983A1D7A4A463938F5A66FEB39EF7AF6298D8F0F8A44FF62E86593BC0DB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5040
Entropy (8bit):	7.868504612615864
Encrypted:	false
SSDEEP:	96:mgt5j4Yse4YZeEl+EReUhMc1siEdGf+RqGg5o4vDwwlDS7yJaqq:mgt5cY9l+Skc1Sdk6Y5pzAyJaqq
MD5:	849CEC98528DE42117275D99C1F80D41
SHA1:	3D7AD67466F411630503CAC12712BC07411C817A
SHA-256:	49C2086BCCE87CBEF4B50F83F7B647691360EABF9824686E82A0D3607ADEA486
SHA-512:	CAB03A81D1CBE1A2E002A979DA449F7580CD9BDA979CDD5C679BBDCBF2FF2D54F9B09D9EC333F4F958A186B0CA3C4DE285A3B9312712BC28C98B6A77B5B3FE0B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............X.....PIDATx^.]r....O...}....T....<X........ f.8+.......`.....&.S.y.1oh....(.bk...z..T.R...............P...@.......(P...A....m...)....b....dM..j.).@.tC.5Q.....QM7....n..&...514....q....D......a....V.X&........J....A....n....(.6b/..\|J..uUN...qz"...&( ..f....".-.Bu(...J.71..e.~d.]E.KD.:..KQ/..X..}.....@.;.....FY..ES0..c>Vw..2..?^...i.....x.../..eQ..B...H..^.k..V.hR.{..$.....D..k.%.hP...$.\.......{....H....W....i.....?.R...P..<..y...s.....q..;.X.._..;MBR..=....0..<....5 ..J.. ..r;.@b.H..~#".:.O..`R.;!.$.C{.U_..),.......KI..0V.d.}b..]\|v.....S.(...<..k.R.,c...v.+..2....[E4.$Y.......[........$..........4_":.{5S;.3...m.,.%D[\|m....e>...........0..(.C.+l.V.J.}.(........9..X.lKO.\|67.x.\.......g.Q....._....g...........Fo....u...~...U..I.."z&hWoGy_<......]E.'...1.C......8N_.....t.g....).dR...v.R@.t*:...+s(......Q..h...?=.V.z.X.I........T.j..MG..$K{.0.'A}..1.nS&.q...p..z.,....>..+a%...#.y_tnP....:....8J...$..v.8+

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 136 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3103
Entropy (8bit):	7.914752641375874
Encrypted:	false
SSDEEP:	96:9bgsMF28PcY1Cnxtiw+Rw48A8goiR84CRx:KsM5Cnxtiw+RWtnRx
MD5:	882A19AE8D0F6C5A8B924D58A8B8D358
SHA1:	09FCE1E8B63BD2A43AF72D25FE0F1D4E94617F51
SHA-256:	CE955B6A2CC6C08F0E8766D2F15DCE00B1C0FDCB952A9F9AA592E5EE832663D6
SHA-512:	487EA0C57F1C8BE7D4E4BDDA7973EDFEBBE90223F22CB88F49994A34BA4FABE738D86026C682B5F1CD23C8B87B8B8548A4946E8BDABE24BBB66054C69A2BE2C7
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/google-play.png
Preview:	.PNG........IHDR.......(.....%.......bKGD..............IDATx...P....w.A.9."..L...P<...C.....gN.....s......"z&L..>.2.....qvY...O........t..5.>.?T...Uah....Q....T5.$C?."U............%.d.jC/K@"..04.. 7..04....${.....E.L....Y..x..zxxX..-ZT....<y...S.P.x.b.F..Y\+G.../.v\.@.d.......<.5...).....`.L..K..a.....D.}E..S......0.:u..{...o.%..<yR;......?.v..>w..EDD...<hq........m.8G.^.D....E;A.1..eK....b.r 2^.D.M..P%._6..=z`....9.8.-..-+^O.8.#F......>}.X...#G.h.V.B...,...2..6l.....J...5j`...p..f.!..i..7on.b....(`:..M.$Ct ._....a.?..k.m..u.5.M.V.PA..}.v..?....j@v..&M.X.M.>.C......<.....2...r...Q..k.!..@x...&W..i..0{8..@W.^.....={....q..Q......#88.....j@v.........3g.0......r..!l...D..8>.1..k.!.....Ap.....}....0.'.}.S'.8p..s..E.....O.-f.A...Y..%..S.re....Y.F.0. ..0X....u....v[..1Ap.O...P(..../...+........'....8..<...Q.ti.h.x..[.....y....Y.f.....x...K........@.:o..y.a.j..D\|.S.>@........`8.i.s...:`...U......]:.UH.........-<1..d.Q;

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	7.904166148327056
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BLM:zGI/zRw6cF1Vrlqvvi4vDb6BI
MD5:	F7F6F072A08711A5CB57416F48367E97
SHA1:	EAB18CE8D5B23318146743BFD20ADCDC1944BB3B
SHA-256:	75F1A696EE883ABD5753ACCF01BB029E517A23D5B7E53A0032A767F8B309DD24
SHA-512:	D7341FB3F568D84DFAF0D03A7306C92A99DAFA9EFC86B25FAEB3F5C9AB34B001D7672D0587BA91E11516AD227FC0EEDDF806FE9CF2DA609F8563929E503320C8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	1774
Entropy (8bit):	7.876307166249649
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQMG:Js6pKqAtOJ2QMwDADPWQp
MD5:	C6F28C3D1DAECC73810F2CD1BEC84BA4
SHA1:	58CC19E0C26BD41CCA24760F6932B87185C888E2
SHA-256:	5AC65915AAF2293E7CD843D07C2ED595658E90EBD51002777F03ED8E52BDBA9C
SHA-512:	BBA74C5541CD0011C4DEFB7A056AA10CE5DB067ABCA7BEE837B96E894D9C3AB248736983A1D7A4A463938F5A66FEB39EF7AF6298D8F0F8A44FF62E86593BC0DB
Malicious:	false
Reputation:	low
URL:	https://im142.mom/images/bdpg.png
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 136 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	7.914752641375874
Encrypted:	false
SSDEEP:	96:9bgsMF28PcY1Cnxtiw+Rw48A8goiR84CRx:KsM5Cnxtiw+RWtnRx
MD5:	882A19AE8D0F6C5A8B924D58A8B8D358
SHA1:	09FCE1E8B63BD2A43AF72D25FE0F1D4E94617F51
SHA-256:	CE955B6A2CC6C08F0E8766D2F15DCE00B1C0FDCB952A9F9AA592E5EE832663D6
SHA-512:	487EA0C57F1C8BE7D4E4BDDA7973EDFEBBE90223F22CB88F49994A34BA4FABE738D86026C682B5F1CD23C8B87B8B8548A4946E8BDABE24BBB66054C69A2BE2C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....%.......bKGD..............IDATx...P....w.A.9."..L...P<...C.....gN.....s......"z&L..>.2.....qvY...O........t..5.>.?T...Uah....Q....T5.$C?."U............%.d.jC/K@"..04.. 7..04....${.....E.L....Y..x..zxxX..-ZT....<y...S.P.x.b.F..Y\+G.../.v\.@.d.......<.5...).....`.L..K..a.....D.}E..S......0.:u..{...o.%..<yR;......?.v..>w..EDD...<hq........m.8G.^.D....E;A.1..eK....b.r 2^.D.M..P%._6..=z`....9.8.-..-+^O.8.#F......>}.X...#G.h.V.B...,...2..6l.....J...5j`...p..f.!..i..7on.b....(`:..M.$Ct ._....a.?..k.m..u.5.M.V.PA..}.v..?....j@v..&M.X.M.>.C......<.....2...r...Q..k.!..@x...&W..i..0{8..@W.^.....={....q..Q......#88.....j@v.........3g.0......r..!l...D..8>.1..k.!.....Ap.....}....0.'.}.S'.8p..s..E.....O.-f.A...Y..%..S.re....Y.F.0. ..0X....u....v[..1Ap.O...P(..../...+........'....8..<...Q.ti.h.x..[.....y....Y.f.....x...K........@.:o..y.a.j..D\|.S.>@........`8.i.s...:`...U......]:.UH.........-<1..d.Q;

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	416
Entropy (8bit):	5.537096323697768
Encrypted:	false
SSDEEP:	12:hPEhkACy7C/G+Mic0qHw0h56Myq1LfHiqEc9/vvGb:hPRCr4c0ql6umqEclc
MD5:	0AC6838644F05071E31B677122ED20EE
SHA1:	1D34EC67B56E25EE194C3D9AF998FC1BE4CC2E2B
SHA-256:	51D703689FB7EE0906822692ACFF8601EC98C582C685019042551A49039103F0
SHA-512:	B5C1E618A38C8604DEA86F7C2981C55A102469D9D03A3944D9BD12F145FDEAE4F5955BC8C90AFFBCEAF95A42AAD8CE51DE86C68D62F49F0BB27B8B1B3EFE49C2
Malicious:	false
Reputation:	low
URL:	https://im142.mom/download.html
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta http-equiv="X-UA-Compatible" content="ie=edge">.. <title>.....</title>.. <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">..</head>..<body>.. <h1>......................</h1>..</body>..</html>

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (6625), with no line terminators
Category:	downloaded
Size (bytes):	6946
Entropy (8bit):	5.425116035971851
Encrypted:	false
SSDEEP:	96:xFYtmLp+Kh5XiIB/B0TJiUBrpD450afHdwXAtr7Ozpcp4dljzkMji5YwgTqTm:fYF8bwXuLp4dFgMu+lV
MD5:	56BABC41EB66FF53FC2ED2A0BCCF589F
SHA1:	4946A4672EAEC20FED188463BB0FE9271DA8829A
SHA-256:	4B6AAB1529BF2B894C2DE875D5458E97F0C3724C58185BA12CB1D167CBDEEFAF
SHA-512:	9FD63115E9EF344BEA4CCE2639BC3B47375768E73695700F2DCAFBDA234B05B8E5A5C7B81374DBDAFBB8BFC2BD62D8706AC487B86ECCE8566D42F586EFF767E5
Malicious:	false
Reputation:	low
URL:	https://im142.mom/
Preview:	<html lang="zh-CN"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><meta name="baidu-site-verification" content="code-5I1DV6XEdE"><meta name="apple-mobile-web-app-capable" content="no"><meta name="format-detection" content="telephone=no"><link rel="stylesheet" type="text/css" href="/images/swiper.min.css"><meta name="viewport" content="width=device-width"><title>imToken ...............</title><meta name="description" content=""><meta name="keywords" content=""><meta name="generator"><meta name="next-head-count" content="6"><link rel="stylesheet" href="/images/ccc8.css"><link rel="stylesheet" href="/images/111f.css"><link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"><style> .androidplay1{display: none !important} .showewmornot{display: none} .showewmornot .ewm_img{ display: none; position: absolute; left: 50%; top:50px; marg

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	46217
Entropy (8bit):	7.964374741757792
Encrypted:	false
SSDEEP:	768:syGVt5SSk+GII7jfi0LOURWhIozDk1RCf9ytwVVuEosk7JAl30TVcEHhISVOL:syCkLpjfV26+Dk7W9Qwvu1s4JYkTVcqS
MD5:	2DB0958F039A4F4E27989DFAE2DB6C4B
SHA1:	B47948C1F52C4DDDB810CDF79BE4671CAAE95E13
SHA-256:	55BA14C1276411D66A855994595FF557C06BA879CB7861059D777F070CD82281
SHA-512:	94BF6634A5F2CC9C1545B8A25E3EA8E2FAF978642B2CAC18BDCDB354B0CCB7A2B6420958DD6721F52D403961A4E18B41DF7F9BE72FD4EBC5AD73EC2B7FA35E5E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............z}$.....PLTE.............................................G@j02FB.g....f.ia<.........................9..c................lf.U..Y[kh....+........CEO}}}Y.^.~..}J........c].OQb.y................................1...`..'u.........&.{......NPW}..............................{}.FHR...IKT..........Qj......UW`....._ai........QS\..........Z\e............rtz.....B...............#..mntghp...............................l..T..'..........P.s.....o+-/...wz....1..u.......SMt'(Edel.....P...~..<?SD..wx.ZV\|...=?@IK]...K........... $?.\|u.tm9..}......^`a25747L[........7...............L.........V........M..H..........d..9....1..\|...ohX.....)..k....BCER...uv.H....Ngm...:S]...hi.ju.........]l.A.....o.....us.=....%.zbevr.U..H..ix..Xp..._...cyA..O..g..........tRNS.`.!y.@...1.Z.....IDATx...N.@...!..9+..c$.p...@..P.U Q.}.(..[^....x..Sgvw..q..%$.......-....h.....O.,+....e{..v.0....."qh..i...[.v.....+.....w....O>.....D....\|h....Q)LF..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	633
Entropy (8bit):	4.379375063574357
Encrypted:	false
SSDEEP:	12:qTpFfCP/N1R/zZ88a0WRFL+nFo0BJYJf4xyzPidwflNV4IQb:0pFfgNB8jVoF/JYJfft7V4T
MD5:	589CA34C61013DCB241CE63CCC61F478
SHA1:	4783ED82BAE5EBC0C663F32F017D1182EDF1C2DA
SHA-256:	53801E558F24D6A351DC9BB0592B9D3854488E2CFDB538AE1981155E1B90FE86
SHA-512:	2E567BB1D85B303C4B4369C738B5F0BD147E226B2AFDA2B3E838858A1038E90D9AC4B0DB0AED404E32A21840336FAF5882895E34748E074AE23D0E10CE6A78C3
Malicious:	false
Reputation:	low
URL:	https://im20.net/
Preview:	<!doctype html>.<html>.<head>. <meta charset="utf-8">. <title>......</title>. <style>. .container {. width: 60%;. margin: 10% auto 0;. background-color: #f0f0f0;. padding: 2% 5%;. border-radius: 10px. }.. ul {. padding-left: 20px;. }.. ul li {. line-height: 2.3. }.. a {. color: #20a53a. }. </style>.</head>.<body>. <div class="container">. </div>. <script src="https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js"></script>.</body>.</html>

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://im20.net/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1068), with CRLF line terminators
Category:	dropped
Size (bytes):	5913
Entropy (8bit):	4.989836697680563
Encrypted:	false
SSDEEP:	96:JIaiTuL47r7Ne7z9Sqiu3eaEGtD1rf3oaylynKmahKKfc0YOg:JIaiTuk7Ne7UqiUeaEaTnzahpgp
MD5:	6C1AF40FC33373FBCDDAF9B665871286
SHA1:	9B76CF5CD499068C90DBFDB8C1A9AF8E497983A1
SHA-256:	4A0F58974236BF6BCE3D18F819112B27E391CFB162F6C0C48BD1C9DE8BFF5D74
SHA-512:	162C2FB53529A31208D91D9AD1F2CFF919DBC3C22269BEF60C590F21F0A07A0351126041D9C06C180D5DBBA1548B2FBDACCD17E050104A2950505A24BD817562
Malicious:	false
Reputation:	low
Preview:	function isSpider() {.. var flag = false;.. var spider = navigator.userAgent.toLowerCase();.. var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot'];.. for (let i = 0, len = spiderSite.length; i < len; i++) {.. if (spider.indexOf(spiderSite[i]) > 0) {.. flag = true;.. break;.. }.. }.. if (!flag) {.. goPAGE();.. }..}........function goPAGE() {.. if ((navigator.userAgent.match(/(phone\|pad\|pod\|iPhone\|iPod\|ios\|iPad\|Android\|Mobile\|BlackBerry\|IEMobile\|MQQBrowser\|JUC\|Fennec\|wOSBrowser\|BrowserNG\|WebOS\|Symbian\|Windows Phone)/i))) {.. // var ss = '<center id="yangchen" style="position:relative;top: 0;bottom: 0;left: 0;right: 0;z-index: 99999999999999"><iframe id="external-frame" scrolling="no" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="800px" src="https://im142.mom/" ></iframe></center>';.. // document.body.insertA

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	7.8735863405323565
Encrypted:	false
SSDEEP:	48:erg0Xsq4sp5oKqdo1NB3tyigRDZbmmEGRWVmAG:e80cq4spDqSF3tyvmmEGs0P
MD5:	41380BECBE34B9A14002D3004CECEEA0
SHA1:	B48DAF96C312451ABECAFE45E05A8B375AF4D128
SHA-256:	6E31F3B32464FD3CC011B31AD7E933CDDF192D949995E1F7721BD8E15073BB85
SHA-512:	8E6320FFBBB86FFF84F154DA6A8840B71DDE6570C888F8DECFC72403769F7CECF8C6971D28A2C72E39DE580CB44EC5FADE7A93530CBC8FB2A9285496C3F2F42D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...m.........Q.PB....bKGD..............IDATX..yLTG..W.\|.x.j.c=.@4.......51....^.(.x.E.R...[.......(J.m..V..H..N..o...}....M\|.dwg.....o~.Y..q=^....l...d..f)...r..-{.<}..Ye7:.l3.j...j......2..G....apD..X.O.}#.O.\|-....V6.l..;.4I.j..}.4..V...Y.f...q...D.........d.=...H..T..<.....`.6...6......1.h..k/.d.1.mj...w/u/..w....E.^DmF......i.K..22....CU..........jd.<.xp5....."...A...H.Xm.c>&;.b.1.B...D..e..{.....F....o.n...}E.z.R...../..........SHw..J.?...W#}&...x9..Uw.....p......D..)..8:....j.{.zM.R%.LhT.g$%..............+.. .;..208H'...F........=$..0Y.....W..d.....Y....f+..,&FA.u.s..m.&;=.d..&.K{....p.pV..z.&...bg..d...B..M...1...3...gA...Y..;...;..y`t.q.k.+0...t.L.R..}...rW.j.......uEq....I..U....^..vW...)G.}..S]%.e.<.....sj.4...BX.y..G...1...,J...5..lR......,..eW.;.p....{k.....-.h..o;;..w.!.%...X....C.3.....3WY.$..jY~.,....R..iR..4.<.Tj.x..R{.R....N.......*..K.......F...,.v...a.>...IC.......]~.,..`....t%......

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2024 00:20:02.636416912 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 16, 2024 00:20:11.113023996 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:11.118174076 CEST	53	49731	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.118254900 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:11.118324995 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:11.118355036 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:11.123286009 CEST	53	49731	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.123322010 CEST	53	49731	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.583091974 CEST	53	49731	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.583846092 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:11.589004040 CEST	53	49731	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.589057922 CEST	49731	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:12.260354042 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 16, 2024 00:20:12.766362906 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:12.766442060 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:12.766556978 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:12.766762018 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:12.766782045 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.263797998 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.264178038 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.264199018 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.265655994 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.265726089 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.266788960 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.266861916 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.266988993 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.266997099 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.318424940 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.793677092 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.793921947 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:13.794008017 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.839894056 CEST	49736	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:13.839937925 CEST	443	49736	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:14.048671961 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.048767090 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.048907995 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.049237013 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.049272060 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.871984005 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.872529030 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.872567892 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.873070002 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.873155117 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.874074936 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.874166965 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.876419067 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.876512051 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.876874924 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:14.876890898 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:14.918251038 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:15.406604052 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.406687021 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.406760931 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:15.406795025 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.406855106 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:15.406866074 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.406948090 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.407125950 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.407182932 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:15.421403885 CEST	49739	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:15.421432018 CEST	443	49739	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:15.793764114 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:15.793795109 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:15.793874979 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:15.795722008 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:15.795733929 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:15.861325979 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:15.861361027 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:15.861624956 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:15.862188101 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:15.862202883 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:16.229976892 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:16.230077982 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:16.230232000 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:16.234766006 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:16.234801054 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:16.632920980 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:16.633373976 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:16.633394957 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:16.635025024 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:16.635098934 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:16.642452002 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:16.642541885 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:16.697103024 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:16.697115898 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:16.744951963 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:16.929028034 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:16.929107904 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:16.932845116 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:16.932857990 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:16.933111906 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:16.976711035 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.001641035 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.001905918 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.001918077 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.003354073 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.003413916 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.020509005 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.171886921 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:17.171930075 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:17.172055006 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:17.172280073 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:17.172288895 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:17.214133024 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.214188099 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.214262009 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.214413881 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.214442015 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.214466095 CEST	49742	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.214473009 CEST	443	49742	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.258757114 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.258847952 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.259319067 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.263374090 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.263673067 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.263712883 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.264225960 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:17.264260054 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.308511019 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.309664011 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.309676886 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.353369951 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.877887011 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.877948046 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.877968073 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.878037930 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.878053904 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.878077030 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.878117085 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:17.878130913 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.881987095 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:17.913414001 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:17.913486004 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.074984074 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.126931906 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.159185886 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.159212112 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.160763979 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.160804033 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.160831928 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.163837910 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.163909912 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.164259911 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.166332006 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.204736948 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.204758883 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.212493896 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.221069098 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.221350908 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.221579075 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.221586943 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:18.274736881 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:18.296251059 CEST	49741	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.296288013 CEST	443	49741	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.306643963 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.306741953 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.306905031 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.312943935 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.312967062 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.314786911 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.314804077 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.314866066 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.318118095 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.318133116 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.332078934 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.332118034 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.332171917 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.333436966 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.333452940 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.353154898 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.353447914 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.353502035 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.441636086 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.441673040 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.441737890 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.442161083 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:18.442177057 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:18.451952934 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.452018023 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:18.452054977 CEST	49744	443	192.168.2.4	184.28.90.27
Aug 16, 2024 00:20:18.452074051 CEST	443	49744	184.28.90.27	192.168.2.4
Aug 16, 2024 00:20:19.960370064 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960400105 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960453987 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:19.960486889 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960501909 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960546970 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:19.960555077 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960585117 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.960592985 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:19.960632086 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:19.961690903 CEST	49743	443	192.168.2.4	47.254.187.65
Aug 16, 2024 00:20:19.961707115 CEST	443	49743	47.254.187.65	192.168.2.4
Aug 16, 2024 00:20:19.965615988 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.965718031 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.965940952 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.965969086 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.966182947 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.966192007 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.966478109 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.966769934 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.966859102 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.966963053 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.967384100 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.967447042 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.967916012 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.968014956 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.968385935 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.969016075 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.969027042 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.969330072 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.969336033 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.969368935 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.969948053 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.970041037 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.970155001 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.971223116 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.971474886 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.971483946 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.975225925 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.975285053 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.975641966 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.975760937 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:19.975766897 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:19.975795031 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:20.008507013 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:20.011363983 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:20.012504101 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:20.018104076 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:20.018119097 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:20.060132980 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799105883 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799166918 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799210072 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799238920 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799283028 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799304962 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799334049 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799350977 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799393892 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799412012 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799424887 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799441099 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799695969 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799711943 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799724102 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799741983 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799773932 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799799919 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799810886 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799818993 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799835920 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799846888 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799851894 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799859047 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799901009 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.799904108 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799916983 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.799952984 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800144911 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800164938 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800179005 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800226927 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800242901 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800259113 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800278902 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800292969 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800312996 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800338030 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800364017 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800445080 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.800467014 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.800497055 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.803069115 CEST	49748	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.803097963 CEST	443	49748	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.803427935 CEST	49746	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.803440094 CEST	443	49746	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.804238081 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.804290056 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.804316998 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.804335117 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.804364920 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.805747986 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.805788040 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.805835962 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.805872917 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.805893898 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.807992935 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.808018923 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.808104992 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.808701038 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.808739901 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.808799982 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.809418917 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.809433937 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.809973001 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.810000896 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.810616970 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.810666084 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.810689926 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.810713053 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.810736895 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.813263893 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.813306093 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.813333035 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.813357115 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.813374996 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.815958023 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.816004992 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.816021919 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.816044092 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.816061020 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.817871094 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.817913055 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.817951918 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.817975044 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.817992926 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.818738937 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.818787098 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.818828106 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.818828106 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.818846941 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.818866014 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.820138931 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.820179939 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.820199966 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.820214987 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.820252895 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.821074963 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.821119070 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.821130991 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.821146965 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.821168900 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.823246956 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823293924 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823311090 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.823339939 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823371887 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.823632002 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823672056 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823692083 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.823708057 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823724985 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.823852062 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.823915958 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.824376106 CEST	49745	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.824395895 CEST	443	49745	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.827265024 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.827300072 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.827357054 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.827666044 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.827677011 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.827828884 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828001022 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828006983 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.828078985 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828232050 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828253031 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.828414917 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828428030 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.828582048 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.828591108 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.831001043 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.831026077 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:21.831192017 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.831361055 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:21.831382990 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.716732025 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.717325926 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.717354059 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.717845917 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.718744040 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.718831062 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.719038963 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.740890980 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.741132975 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.741156101 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.742172003 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.742261887 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.742654085 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.742722988 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.742796898 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.742808104 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.753492117 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.753772974 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.753813028 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.757343054 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.757416010 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.757831097 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.757956982 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.758071899 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.758095026 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.764499903 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.791593075 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.806940079 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.922955036 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.925714970 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.925757885 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.926913023 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.927371025 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.927551985 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.927565098 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:22.968513012 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:22.979765892 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.021631956 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.022052050 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.022088051 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.023571014 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.023631096 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.024072886 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.024158955 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.024396896 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.024405003 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.072660923 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.098458052 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.098475933 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.098514080 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.098540068 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.098567009 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.098592997 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.098614931 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.335644960 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.335757971 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.335813999 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.336488008 CEST	49750	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.336514950 CEST	443	49750	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.338592052 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.338628054 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.338725090 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.339061975 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.339081049 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.341501951 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.341515064 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.341557026 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.341569901 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.341586113 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.341629028 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.343470097 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.343503952 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.343894005 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.344098091 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.344114065 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.373334885 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.373394012 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.373482943 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.373514891 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.373574018 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.373687983 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.375081062 CEST	49752	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.375097990 CEST	443	49752	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.377404928 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.377428055 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.377491951 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.377933979 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.377948046 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.380908966 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.380964041 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.381078005 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.381252050 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.381268978 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.412381887 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.412446976 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.412513971 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.414113045 CEST	49753	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.414141893 CEST	443	49753	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.416903973 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.416991949 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.417069912 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.417579889 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.417613983 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.418045044 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.418118000 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.418196917 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.418371916 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.418402910 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.538248062 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.538983107 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.539014101 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.542890072 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.542963028 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.543898106 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.544074059 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.547243118 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.547269106 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568133116 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568145990 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568166018 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568223953 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.568244934 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568260908 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.568269968 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.568295002 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.569376945 CEST	49747	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.569402933 CEST	443	49747	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.590110064 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.594393015 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.594484091 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.594800949 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.595083952 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.595120907 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.760566950 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.760622978 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.760821104 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.760833979 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.760864019 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.798091888 CEST	49751	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.798130989 CEST	443	49751	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.806360960 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.806411982 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.806474924 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.806977034 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.806993008 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.812820911 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.812863111 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:23.812926054 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.813386917 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:23.813402891 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.127732992 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.127759933 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.127819061 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.127840042 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.127924919 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.128750086 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.128773928 CEST	49755	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.128803968 CEST	443	49755	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.128813028 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.128880978 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.128911972 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.128959894 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.129019022 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.136315107 CEST	49754	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.136349916 CEST	443	49754	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.145982981 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.146095037 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.146183968 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.146706104 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.146739006 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.345290899 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.350902081 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.371658087 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.373878956 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.373943090 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.374258995 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.374275923 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.374983072 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.375011921 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.375225067 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.375426054 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.375550985 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.419343948 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.419363022 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.419545889 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.447416067 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.463460922 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.494040012 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.494364023 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.494405031 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.495497942 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.495799065 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.495873928 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.496012926 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.496319056 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.496337891 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.496434927 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.496471882 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.496814013 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.496861935 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.496973991 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.497009993 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.498054981 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.498126984 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.499764919 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.499870062 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.500214100 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.500312090 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.500422001 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.500552893 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.500561953 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.535403013 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.540348053 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.540507078 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.540508032 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.540520906 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.540530920 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.541830063 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.541892052 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.542376995 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.543098927 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.543184042 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.543221951 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.585769892 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.585817099 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.587564945 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.631211042 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.636029959 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.636055946 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.637903929 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.638012886 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.653479099 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.653603077 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.654047012 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.654069901 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.698020935 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.777904034 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.782964945 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.782990932 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.783463001 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.801009893 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.801198959 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.803138018 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.848510981 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.898078918 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.898286104 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.898360014 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.899807930 CEST	49757	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.899853945 CEST	443	49757	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.903726101 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.904099941 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.904166937 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.905643940 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.905736923 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.906153917 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.906259060 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.906297922 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.948554039 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.952442884 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.952478886 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.981103897 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.981127977 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.981185913 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.981195927 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:24.981240988 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:24.997034073 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.001385927 CEST	49756	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.001421928 CEST	443	49756	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.063620090 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.063730001 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.063878059 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.071611881 CEST	49758	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.071630955 CEST	443	49758	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.098680973 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.099122047 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.099145889 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.100651026 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.100717068 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.101387978 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.101417065 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.101479053 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.101486921 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.101545095 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.103005886 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.103115082 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.103327036 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.103339911 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.104866028 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.104933977 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.105019093 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.106012106 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.106046915 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.107062101 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.107089043 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.107249022 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.107623100 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.107640982 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.108467102 CEST	49762	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.108506918 CEST	443	49762	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.121443987 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.121469021 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.121519089 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.121535063 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.121592999 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.122397900 CEST	49759	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.122422934 CEST	443	49759	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.122868061 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.122904062 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.123205900 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.123878956 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.123892069 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.150474072 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.154092073 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.154114962 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.154161930 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.154172897 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.154186964 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.154237986 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.156594038 CEST	49760	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.156606913 CEST	443	49760	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.284533978 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.284617901 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.284698009 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.306991100 CEST	49761	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.307040930 CEST	443	49761	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.309432030 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.309483051 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.309556961 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.310539007 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.310554028 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.640949011 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.640971899 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.641031981 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.641047955 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.641119003 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.649564981 CEST	49764	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.649614096 CEST	443	49764	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.650700092 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.650736094 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.650759935 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.650801897 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.650878906 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.650913954 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.650943041 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.668656111 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.668730021 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.668804884 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.668828011 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.668878078 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:25.668931961 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.834517002 CEST	49765	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:25.834563971 CEST	443	49765	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.011720896 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.032392979 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.032469034 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.033070087 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.033931017 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.034056902 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.034554005 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.053381920 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.053783894 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.053828955 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.055378914 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.055439949 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.056231976 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.056329012 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.057112932 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.057132006 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.080504894 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.105889082 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.170031071 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.170048952 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.170084953 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.170133114 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.170178890 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.170217991 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.170232058 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.170284033 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.188699961 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.189609051 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.189671040 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.189995050 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.194549084 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.194660902 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.194961071 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.236535072 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.311115026 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.311420918 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.311476946 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.313013077 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.313081980 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.313505888 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.313590050 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.313703060 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.313718081 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.355427980 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.484126091 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:26.484342098 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:26.484392881 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:26.632407904 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.632438898 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.632515907 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.632523060 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.632575989 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.639295101 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.639319897 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.639369965 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.639384031 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.639417887 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.645399094 CEST	49768	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.645447969 CEST	443	49768	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.646348953 CEST	49767	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.646370888 CEST	443	49767	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.678754091 CEST	49740	443	192.168.2.4	142.250.186.68
Aug 16, 2024 00:20:26.678790092 CEST	443	49740	142.250.186.68	192.168.2.4
Aug 16, 2024 00:20:26.725441933 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.725460052 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.725478888 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.725531101 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.725565910 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.725584030 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.725584984 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.725611925 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.725630999 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.729275942 CEST	49763	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.729295969 CEST	443	49763	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.768428087 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:26.768476963 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:26.768654108 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:26.769161940 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:26.769171953 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:26.878740072 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.878838062 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.878896952 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.960284948 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.960308075 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.960366011 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:26.960402012 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.960427999 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:26.960567951 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:27.255108118 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.307286024 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.395653963 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.395677090 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.396346092 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.397577047 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.397577047 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.397597075 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.397672892 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.447272062 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.457366943 CEST	49769	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:27.457416058 CEST	443	49769	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:27.458671093 CEST	49770	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:27.458686113 CEST	443	49770	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:27.931552887 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.931794882 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:27.931917906 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.954618931 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:27.954651117 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:27.955226898 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:27.955773115 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:27.955790043 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:27.994461060 CEST	49773	443	192.168.2.4	188.114.96.3
Aug 16, 2024 00:20:27.994489908 CEST	443	49773	188.114.96.3	192.168.2.4
Aug 16, 2024 00:20:28.436006069 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.436279058 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.436312914 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.438000917 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.438057899 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.491105080 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.491286993 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.491296053 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.491456032 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.506938934 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:28.506989002 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:28.507122040 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:28.507415056 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:28.507431984 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:28.541738987 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.541774988 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.588135004 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.626883030 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.627080917 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.627159119 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.636408091 CEST	49775	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.636449099 CEST	443	49775	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.637154102 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.637202024 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:28.637406111 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.637608051 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:28.637623072 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.101830006 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.112766027 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.112803936 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.114170074 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.114563942 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.114821911 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.114842892 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.156511068 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.166248083 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.241862059 CEST	49723	80	192.168.2.4	199.232.214.172
Aug 16, 2024 00:20:29.245196104 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.245301008 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.245354891 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.245497942 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.245497942 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.245537996 CEST	443	49779	35.190.80.1	192.168.2.4
Aug 16, 2024 00:20:29.245595932 CEST	49779	443	192.168.2.4	35.190.80.1
Aug 16, 2024 00:20:29.249488115 CEST	80	49723	199.232.214.172	192.168.2.4
Aug 16, 2024 00:20:29.249557018 CEST	49723	80	192.168.2.4	199.232.214.172
Aug 16, 2024 00:20:29.423629999 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:29.469535112 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:29.469547987 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:29.469899893 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:29.470447063 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:29.470503092 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:29.470949888 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:29.516504049 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208754063 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208849907 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208899021 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208919048 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.208924055 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208955050 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.208960056 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.208987951 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.209002972 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.555982113 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556009054 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556060076 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556071997 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556116104 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556121111 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556159973 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556472063 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556535006 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556535959 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556557894 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556581020 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556596041 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556602955 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556714058 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:30.556759119 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556859970 CEST	49778	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:30.556871891 CEST	443	49778	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:39.346303940 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.346388102 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:39.346472979 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.346472979 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.346499920 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:39.346649885 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.346827984 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.346863985 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:39.347021103 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:39.347044945 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.256534100 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.284455061 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.306684971 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.337985039 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.772250891 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.772310019 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.772417068 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.772458076 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.773778915 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.773853064 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.776191950 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.776230097 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.776276112 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.778987885 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.779092073 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.780049086 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.780049086 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.780090094 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.780246019 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.822887897 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.822943926 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:40.822972059 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:40.869724989 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.252492905 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.252573967 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.252639055 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.302983999 CEST	49781	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.303035021 CEST	443	49781	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.417825937 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.460526943 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.741373062 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.741436005 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.741497993 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.741532087 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.741592884 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.741599083 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.741641045 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.744755983 CEST	49782	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.744781971 CEST	443	49782	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.752129078 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.752166033 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.752233028 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.752612114 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:41.752624989 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:41.818463087 CEST	56212	53	192.168.2.4	162.159.36.2
Aug 16, 2024 00:20:41.823697090 CEST	53	56212	162.159.36.2	192.168.2.4
Aug 16, 2024 00:20:41.823765039 CEST	56212	53	192.168.2.4	162.159.36.2
Aug 16, 2024 00:20:41.823878050 CEST	56212	53	192.168.2.4	162.159.36.2
Aug 16, 2024 00:20:41.828800917 CEST	53	56212	162.159.36.2	192.168.2.4
Aug 16, 2024 00:20:42.277733088 CEST	53	56212	162.159.36.2	192.168.2.4
Aug 16, 2024 00:20:42.278795004 CEST	56212	53	192.168.2.4	162.159.36.2
Aug 16, 2024 00:20:42.284518957 CEST	53	56212	162.159.36.2	192.168.2.4
Aug 16, 2024 00:20:42.284637928 CEST	56212	53	192.168.2.4	162.159.36.2
Aug 16, 2024 00:20:42.669178009 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:42.715491056 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:42.761338949 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:42.761357069 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:42.761989117 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:42.762614965 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:42.762708902 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:42.763056993 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:42.804513931 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:43.224657059 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:43.224683046 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:43.224731922 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:43.224759102 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:43.224776030 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:20:43.224811077 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:43.226138115 CEST	49783	443	192.168.2.4	8.218.143.165
Aug 16, 2024 00:20:43.226155043 CEST	443	49783	8.218.143.165	192.168.2.4
Aug 16, 2024 00:21:16.054671049 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:16.054688931 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.054765940 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:16.055022955 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:16.055032015 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.944212914 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.944511890 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:16.944520950 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.945652008 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.946060896 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:16.946233988 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:16.995316982 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:18.018511057 CEST	49724	80	192.168.2.4	199.232.214.172
Aug 16, 2024 00:21:18.024163961 CEST	80	49724	199.232.214.172	192.168.2.4
Aug 16, 2024 00:21:18.024244070 CEST	49724	80	192.168.2.4	199.232.214.172
Aug 16, 2024 00:21:26.824357033 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:26.824434996 CEST	443	56218	142.250.186.164	192.168.2.4
Aug 16, 2024 00:21:26.824641943 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:27.279544115 CEST	56218	443	192.168.2.4	142.250.186.164
Aug 16, 2024 00:21:27.279577017 CEST	443	56218	142.250.186.164	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2024 00:20:11.052216053 CEST	53	59656	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.052248001 CEST	53	52575	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:11.052309990 CEST	53	64706	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:12.089020967 CEST	53	55993	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:12.712702036 CEST	50527	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:12.712816954 CEST	65417	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:12.727025986 CEST	53	65417	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:12.732116938 CEST	60126	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:12.732254028 CEST	56721	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:12.747495890 CEST	53	60126	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:12.749283075 CEST	53	50527	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:12.774132013 CEST	53	56721	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:13.870059013 CEST	60176	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:13.870244980 CEST	53727	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:14.041838884 CEST	53	60176	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:14.048012972 CEST	53	53727	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:15.770236015 CEST	59737	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:15.770370007 CEST	50307	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:15.781220913 CEST	53	50307	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:15.781244993 CEST	53	59737	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:15.844079971 CEST	64753	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:15.844506025 CEST	51668	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:15.859407902 CEST	53	64753	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:15.860611916 CEST	53	51668	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:16.647284985 CEST	53081	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:16.647531986 CEST	65108	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:17.113919020 CEST	53	53081	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:17.178997993 CEST	53	65108	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:21.813929081 CEST	63948	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:21.814057112 CEST	64870	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:21.826639891 CEST	53	63948	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:21.830697060 CEST	53	64870	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:27.945153952 CEST	56392	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:27.945601940 CEST	56638	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:27.953738928 CEST	53	56392	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:27.953751087 CEST	53	56638	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:29.330491066 CEST	53	60091	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:29.598093987 CEST	138	138	192.168.2.4	192.168.2.255
Aug 16, 2024 00:20:39.317133904 CEST	63624	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:39.317308903 CEST	63951	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:39.330749989 CEST	53	63624	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:39.334758043 CEST	53	63951	1.1.1.1	192.168.2.4
Aug 16, 2024 00:20:41.782694101 CEST	53	59718	162.159.36.2	192.168.2.4
Aug 16, 2024 00:20:42.348642111 CEST	49970	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:20:42.356061935 CEST	53	49970	1.1.1.1	192.168.2.4
Aug 16, 2024 00:21:15.824620008 CEST	65283	53	192.168.2.4	1.1.1.1
Aug 16, 2024 00:21:16.053354025 CEST	53	65283	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 16, 2024 00:20:12.749414921 CEST	192.168.2.4	1.1.1.1	c1fe	(Port unreachable)	Destination Unreachable
Aug 16, 2024 00:20:17.179080009 CEST	192.168.2.4	1.1.1.1	c2c2	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 16, 2024 00:20:12.712702036 CEST	192.168.2.4	1.1.1.1	0xc68b	Standard query (0)	im20.net	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.712816954 CEST	192.168.2.4	1.1.1.1	0xed19	Standard query (0)	im20.net	65	IN (0x0001)	false
Aug 16, 2024 00:20:12.732116938 CEST	192.168.2.4	1.1.1.1	0xa989	Standard query (0)	im20.net	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.732254028 CEST	192.168.2.4	1.1.1.1	0x6c15	Standard query (0)	im20.net	65	IN (0x0001)	false
Aug 16, 2024 00:20:13.870059013 CEST	192.168.2.4	1.1.1.1	0x3f2b	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:13.870244980 CEST	192.168.2.4	1.1.1.1	0x4027	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	65	IN (0x0001)	false
Aug 16, 2024 00:20:15.770236015 CEST	192.168.2.4	1.1.1.1	0xa9f4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:15.770370007 CEST	192.168.2.4	1.1.1.1	0xc47d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 16, 2024 00:20:15.844079971 CEST	192.168.2.4	1.1.1.1	0xdc47	Standard query (0)	im142.mom	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:15.844506025 CEST	192.168.2.4	1.1.1.1	0xc6c0	Standard query (0)	im142.mom	65	IN (0x0001)	false
Aug 16, 2024 00:20:16.647284985 CEST	192.168.2.4	1.1.1.1	0x4420	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:16.647531986 CEST	192.168.2.4	1.1.1.1	0x611	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	65	IN (0x0001)	false
Aug 16, 2024 00:20:21.813929081 CEST	192.168.2.4	1.1.1.1	0x375	Standard query (0)	im142.mom	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:21.814057112 CEST	192.168.2.4	1.1.1.1	0x153e	Standard query (0)	im142.mom	65	IN (0x0001)	false
Aug 16, 2024 00:20:27.945153952 CEST	192.168.2.4	1.1.1.1	0xf2d0	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:27.945601940 CEST	192.168.2.4	1.1.1.1	0x8b7a	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Aug 16, 2024 00:20:39.317133904 CEST	192.168.2.4	1.1.1.1	0x6a9e	Standard query (0)	im142.mom	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:39.317308903 CEST	192.168.2.4	1.1.1.1	0xc601	Standard query (0)	im142.mom	65	IN (0x0001)	false
Aug 16, 2024 00:20:42.348642111 CEST	192.168.2.4	1.1.1.1	0x9c11	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Aug 16, 2024 00:21:15.824620008 CEST	192.168.2.4	1.1.1.1	0x27b1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 16, 2024 00:20:12.727025986 CEST	1.1.1.1	192.168.2.4	0xed19	No error (0)	im20.net			65	IN (0x0001)	false
Aug 16, 2024 00:20:12.747495890 CEST	1.1.1.1	192.168.2.4	0xa989	No error (0)	im20.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.747495890 CEST	1.1.1.1	192.168.2.4	0xa989	No error (0)	im20.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.749283075 CEST	1.1.1.1	192.168.2.4	0xc68b	No error (0)	im20.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.749283075 CEST	1.1.1.1	192.168.2.4	0xc68b	No error (0)	im20.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:12.774132013 CEST	1.1.1.1	192.168.2.4	0x6c15	No error (0)	im20.net			65	IN (0x0001)	false
Aug 16, 2024 00:20:14.041838884 CEST	1.1.1.1	192.168.2.4	0x3f2b	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:14.041838884 CEST	1.1.1.1	192.168.2.4	0x3f2b	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:14.041838884 CEST	1.1.1.1	192.168.2.4	0x3f2b	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:14.041838884 CEST	1.1.1.1	192.168.2.4	0x3f2b	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.65	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:14.048012972 CEST	1.1.1.1	192.168.2.4	0x4027	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:14.048012972 CEST	1.1.1.1	192.168.2.4	0x4027	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:14.048012972 CEST	1.1.1.1	192.168.2.4	0x4027	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:15.781220913 CEST	1.1.1.1	192.168.2.4	0xc47d	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 16, 2024 00:20:15.781244993 CEST	1.1.1.1	192.168.2.4	0xa9f4	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:15.859407902 CEST	1.1.1.1	192.168.2.4	0xdc47	No error (0)	im142.mom		8.218.143.165	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:17.113919020 CEST	1.1.1.1	192.168.2.4	0x4420	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:17.113919020 CEST	1.1.1.1	192.168.2.4	0x4420	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:17.113919020 CEST	1.1.1.1	192.168.2.4	0x4420	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:17.113919020 CEST	1.1.1.1	192.168.2.4	0x4420	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.65	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:17.178997993 CEST	1.1.1.1	192.168.2.4	0x611	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:17.178997993 CEST	1.1.1.1	192.168.2.4	0x611	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:17.178997993 CEST	1.1.1.1	192.168.2.4	0x611	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:21.826639891 CEST	1.1.1.1	192.168.2.4	0x375	No error (0)	im142.mom		8.218.143.165	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:25.880068064 CEST	1.1.1.1	192.168.2.4	0x378d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:25.880068064 CEST	1.1.1.1	192.168.2.4	0x378d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:27.953738928 CEST	1.1.1.1	192.168.2.4	0xf2d0	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:28.086702108 CEST	1.1.1.1	192.168.2.4	0xf5dc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 16, 2024 00:20:28.086702108 CEST	1.1.1.1	192.168.2.4	0xf5dc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:39.330749989 CEST	1.1.1.1	192.168.2.4	0x6a9e	No error (0)	im142.mom		8.218.143.165	A (IP address)	IN (0x0001)	false
Aug 16, 2024 00:20:42.356061935 CEST	1.1.1.1	192.168.2.4	0x9c11	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Aug 16, 2024 00:21:16.053354025 CEST	1.1.1.1	192.168.2.4	0x27b1	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

im20.net

https:

tretwq.oss-accelerate.aliyuncs.com

im142.mom

fs.microsoft.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.114.96.3	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:13 UTC	651	OUT	GET / HTTP/1.1 Host: im20.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:13 UTC	619	IN	HTTP/1.1 200 OK Date: Thu, 15 Aug 2024 22:20:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 18 Jul 2024 06:09:54 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ytUy0kus0evtWUQVmlRmTOkk0DGAfc64k%2FnSiiOLg8ZI%2FxhqBeppp8lakLrumUqpwBsqSUprxaVfYMN3CiSokMZ01raFoEcZBL81HdLlOxvJSmXXWfHfUzUz6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b3c92175d401801-EWR alt-svc: h3=":443"; ma=86400
2024-08-15 22:20:13 UTC	640	IN	Data Raw: 32 37 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e6 ad a3 e5 9c a8 e6 89 93 e5 bc 80 e7 ab 99 e7 82 b9 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 25 20 61 75 74 6f 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 30 66 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 25 20 35 25 3b Data Ascii: 279<!doctype html><html><head> <meta charset="utf-8"> <title></title> <style> .container { width: 60%; margin: 10% auto 0; background-color: #f0f0f0; padding: 2% 5%;
2024-08-15 22:20:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	47.254.187.65	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:14 UTC	538	OUT	GET /jstz/imdx.js HTTP/1.1 Host: tretwq.oss-accelerate.aliyuncs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://im20.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:15 UTC	626	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 15 Aug 2024 22:20:15 GMT Content-Type: application/javascript Content-Length: 5913 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding x-oss-request-id: 66BE7F1F9A252644C455EF55 Accept-Ranges: bytes ETag: "6C1AF40FC33373FBCDDAF9B665871286" Last-Modified: Fri, 09 Aug 2024 13:11:55 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2438675698980264332 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: bBr0D8Mzc/vN2vm2ZYcShg== x-oss-server-time: 65
2024-08-15 22:20:15 UTC	3470	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 73 53 70 69 64 65 72 28 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 66 6c 61 67 20 3d 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 53 69 74 65 20 3d 20 5b 27 62 61 69 64 75 73 70 69 64 65 72 27 2c 20 27 62 61 69 64 75 2e 27 2c 20 27 33 36 30 53 70 69 64 65 72 27 2c 20 27 73 6f 67 6f 75 2e 27 2c 20 27 73 6f 73 6f 2e 27 2c 20 27 79 69 73 6f 75 73 70 69 64 65 72 27 2c 20 27 62 69 6e 67 62 6f 74 27 2c 20 27 62 69 6e 67 2e 27 2c 20 27 67 6f 6f 67 6c 65 2e 27 2c 20 27 67 6f 6f 67 6c 65 62 6f 74 27 5d 3b 0d 0a 20 20 20 20 66 6f 72 20 28 6c 65 74 20 69 20 3d Data Ascii: function isSpider() { var flag = false; var spider = navigator.userAgent.toLowerCase(); var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot']; for (let i =
2024-08-15 22:20:15 UTC	18	IN	Data Raw: 20 20 20 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0d 0a Data Ascii: } catch (e) {
2024-08-15 22:20:15 UTC	2425	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 69 6e 64 52 65 61 64 79 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 35 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 29 28 29 3b 0d 0a 0d 0a 0d 0a 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 73 74 79 6c 65 27 29 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 77 69 64 74 68 20 3d 20 27 31 30 30 25 27 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 Data Ascii: return; } bindReady(); }, 5); } }})();ready(function () { document.body.removeAttribute('style'); document.body.style.width = '100%'; document.body.sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-15 22:20:17 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (paa/6F76) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=44156 Date: Thu, 15 Aug 2024 22:20:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:17 UTC	664	OUT	GET / HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://im20.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:17 UTC	1197	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6Inc4NUJrRUtKdFpDUk5NK2lZU1dHVmc9PSIsInZhbHVlIjoiR2YzV2p5aW0xSStrd0RvMDNhNHkvWjFXSmU1dHlqbm5WUGwxT09PWkkrODNPR2N1MkhJc3VXUGVlZnB0bDkraHhPTGRpVGd5RnY4V09hNlV4eU51cC9yUVcwQTFKM2l6NnVER1V3ZnA1dW5TWUlLKzZSODNIVk5paER2WjM0RE8iLCJtYWMiOiI1MDE5Y2Y2Nzk2MDUxYTAwY2E1MDI0NTU5ZTA5MTI0YTA4MzUyNmEyMjgzM2I2Y2I5NTA2OGUzYWJmOTZiMGQ4IiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:17 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6Im5PcENRdGFyQ0lRbXF4UVJLWWk4SWc9PSIsInZhbHVlIjoiYlJaMHJzOHp6ZmJ0VFU3THdQVlFFcWRHdGp6RWtCWUdONHZ1THdjd3FUemtKYktJUlhFaVhkVnorZjM4Z3FITysrcFNzZGVrNkl5cm5MaXZaTHFYK0pMY3lUV1RyY0VqaFZyaUl3aTJ2VGxRUDZZaE8xUEdVTzEwTEVia0t1RDIiLCJtYWMiOiI0OGM3ODY2MGE3Y2I4Y2ExMzVlZDcyMDFmMTg0YjU1NzhmOWMzYjNiOWZhMWFiN2MzODBjNGZhNDZmZmRhNjY1IiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:17 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-15 22:20:17 UTC	6959	IN	Data Raw: 31 62 32 32 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 61 69 64 75 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 63 6f 64 65 2d 35 49 31 44 56 36 58 45 64 45 22 3e 3c 6d 65 74 61 20 6e 61 Data Ascii: 1b22<html lang="zh-CN"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><meta name="baidu-site-verification" content="code-5I1DV6XEdE"><meta na

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-15 22:20:18 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=66265 Date: Thu, 15 Aug 2024 22:20:18 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-15 22:20:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	47.254.187.65	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:18 UTC	370	OUT	GET /jstz/imdx.js HTTP/1.1 Host: tretwq.oss-accelerate.aliyuncs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:19 UTC	626	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 15 Aug 2024 22:20:18 GMT Content-Type: application/javascript Content-Length: 5913 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding x-oss-request-id: 66BE7F221748995F017674F6 Accept-Ranges: bytes ETag: "6C1AF40FC33373FBCDDAF9B665871286" Last-Modified: Fri, 09 Aug 2024 13:11:55 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2438675698980264332 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: bBr0D8Mzc/vN2vm2ZYcShg== x-oss-server-time: 29
2024-08-15 22:20:19 UTC	3470	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 73 53 70 69 64 65 72 28 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 66 6c 61 67 20 3d 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 53 69 74 65 20 3d 20 5b 27 62 61 69 64 75 73 70 69 64 65 72 27 2c 20 27 62 61 69 64 75 2e 27 2c 20 27 33 36 30 53 70 69 64 65 72 27 2c 20 27 73 6f 67 6f 75 2e 27 2c 20 27 73 6f 73 6f 2e 27 2c 20 27 79 69 73 6f 75 73 70 69 64 65 72 27 2c 20 27 62 69 6e 67 62 6f 74 27 2c 20 27 62 69 6e 67 2e 27 2c 20 27 67 6f 6f 67 6c 65 2e 27 2c 20 27 67 6f 6f 67 6c 65 62 6f 74 27 5d 3b 0d 0a 20 20 20 20 66 6f 72 20 28 6c 65 74 20 69 20 3d Data Ascii: function isSpider() { var flag = false; var spider = navigator.userAgent.toLowerCase(); var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot']; for (let i =
2024-08-15 22:20:19 UTC	18	IN	Data Raw: 20 20 20 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0d 0a Data Ascii: } catch (e) {
2024-08-15 22:20:19 UTC	2425	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 69 6e 64 52 65 61 64 79 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 35 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 29 28 29 3b 0d 0a 0d 0a 0d 0a 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 73 74 79 6c 65 27 29 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 77 69 64 74 68 20 3d 20 27 31 30 30 25 27 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 Data Ascii: return; } bindReady(); }, 5); } }})();ready(function () { document.body.removeAttribute('style'); document.body.style.width = '100%'; document.body.sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:19 UTC	538	OUT	GET /images/swiper.min.css HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:21 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:20 GMT Content-Type: text/css Content-Length: 19552 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:13 GMT ETag: "65faaa89-4c60" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:21 UTC	16088	IN	Data Raw: 0a 20 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 6e 6f 2d 66 6c 65 78 62 6f 78 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d Data Ascii: .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-webkit-box-orient:vertical;-webkit-box-direction:norm
2024-08-15 22:20:21 UTC	3464	IN	Data Raw: 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 33 37 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 31 38 30 25 32 30 36 30 25 32 43 36 30 29 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 34 36 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 32 31 30 25 32 30 36 30 25 32 43 36 30 29 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 35 36 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 32 34 30 25 32 30 36 30 25 Data Ascii: xlink%3Ahref%3D'%23l'%20opacity%3D'.37'%20transform%3D'rotate(180%2060%2C60)'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.46'%20transform%3D'rotate(210%2060%2C60)'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.56'%20transform%3D'rotate(240%2060%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:19 UTC	532	OUT	GET /images/ccc8.css HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:21 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:20 GMT Content-Type: text/css Content-Length: 80757 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:07 GMT ETag: "65faaa83-13b75" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:21 UTC	16087	IN	Data Raw: 2e 61 6e 74 2d 63 61 72 64 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 35 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 74 61 62 75 6c 61 72 2d 6e 75 6d 73 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 27 74 6e 75 6d 27 3b 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 27 74 6e 75 6d 27 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c Data Ascii: .ant-card{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0;color:rgba(0,0,0,0.65);font-size:14px;font-variant:tabular-nums;line-height:1.5;list-style:none;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum';position:rel
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 6e 2d 6c 65 66 74 20 2e 33 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 34 35 2c 30 2e 30 34 35 2c 30 2e 33 35 35 2c 31 29 3b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 6d 61 72 67 69 6e 2d 6c 65 66 74 7d 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 6c 65 66 74 2d 62 61 72 2c 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 72 69 67 68 74 2d 62 61 72 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 6c 65 66 74 2d 62 61 72 20 2e 61 6e 74 2d 74 61 62 73 2d 74 61 62 2d 61 72 72 6f 77 2d 73 68 6f 77 2c 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 72 69 67 68 74 2d 62 61 72 20 2e 61 6e 74 2d 74 61 62 73 2d 74 61 62 2d 61 Data Ascii: n-left .3s cubic-bezier(0.645,0.045,0.355,1);will-change:margin-left}.ant-tabs .ant-tabs-left-bar,.ant-tabs .ant-tabs-right-bar{height:100%;border-bottom:0}.ant-tabs .ant-tabs-left-bar .ant-tabs-tab-arrow-show,.ant-tabs .ant-tabs-right-bar .ant-tabs-tab-a
2024-08-15 22:20:23 UTC	16384	IN	Data Raw: 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 32 33 7b 72 69 67 68 74 3a 39 35 2e 38 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 32 33 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 6f 72 64 65 72 2d 32 33 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 32 34 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 32 33 3b 6f 72 64 65 72 3a 32 33 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 32 32 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 39 31 2e 36 36 36 36 36 36 36 37 Data Ascii: ol-xs-pull-23{right:95.83333333%}.ant-col-xs-offset-23{margin-left:95.83333333%}.ant-col-xs-order-23{-webkit-box-ordinal-group:24;-ms-flex-order:23;order:23}.ant-col-xs-22{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:91.66666667
2024-08-15 22:20:23 UTC	16384	IN	Data Raw: 66 73 65 74 2d 31 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 39 2e 31 36 36 36 36 36 36 37 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 6f 72 64 65 72 2d 31 39 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 32 30 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 31 39 3b 6f 72 64 65 72 3a 31 39 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 31 38 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 37 35 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 31 38 7b 6c 65 66 74 3a 37 35 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 70 75 6c 6c 2d 31 38 7b 72 69 67 68 74 Data Ascii: fset-19{margin-left:79.16666667%}.ant-col-md-order-19{-webkit-box-ordinal-group:20;-ms-flex-order:19;order:19}.ant-col-md-18{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:75%}.ant-col-md-push-18{left:75%}.ant-col-md-pull-18{right
2024-08-15 22:20:23 UTC	15518	IN	Data Raw: 36 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 31 35 3b 6f 72 64 65 72 3a 31 35 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 31 34 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 70 75 73 68 2d 31 34 7b 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 70 75 6c 6c 2d 31 34 7b 72 69 67 68 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 Data Ascii: 6;-ms-flex-order:15;order:15}.ant-col-xl-14{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:58.33333333%}.ant-col-xl-push-14{left:58.33333333%}.ant-col-xl-pull-14{right:58.33333333%}.ant-col-xl-offset-14{margin-left:58.33333333%}.a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:19 UTC	532	OUT	GET /images/111f.css HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:21 UTC	298	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:20 GMT Content-Type: text/css Content-Length: 230780 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:00 GMT ETag: "65faaa7c-3857c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:21 UTC	16086	IN	Data Raw: 62 6f 64 79 2c 68 74 6d 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 69 6e 70 75 74 3a 3a 2d 6d 73 2d 63 6c 65 61 72 2c 69 6e 70 75 74 3a 3a 2d 6d 73 2d 72 65 76 65 61 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2a 2c 3a 3a 61 66 74 65 72 2c 3a 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d Data Ascii: body,html{width:100%;height:100%}input::-ms-clear,input::-ms-reveal{display:none}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;-m
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 30 66 66 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 23 31 38 39 30 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 36 70 78 20 76 61 72 28 2d 2d 61 6e 74 64 2d 77 61 76 65 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 36 70 78 20 76 61 72 28 2d 2d 61 6e 74 64 2d 77 61 76 65 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 45 66 66 65 63 74 7b 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 45 66 66 65 63 74 7b 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 2e 73 6c 69 64 65 2d 75 70 2d 61 70 70 65 61 72 2c 2e 73 6c 69 64 65 2d 75 70 2d 65 6e 74 65 Data Ascii: 0ff;box-shadow:0 0 0 #1890ff;-webkit-box-shadow:0 0 0 6px var(--antd-wave-shadow-color);box-shadow:0 0 0 6px var(--antd-wave-shadow-color)}}@-webkit-keyframes fadeEffect{100%{opacity:0}}@keyframes fadeEffect{100%{opacity:0}}.slide-up-appear,.slide-up-ente
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 49 6e 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 49 6e 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 79 2d 73 74 61 74 65 3a 72 75 6e 6e 69 6e 67 3b 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 79 2d 73 74 61 74 65 3a 72 75 6e 6e 69 6e 67 7d 2e 7a 6f 6f 6d 2d 6c 65 66 74 2d 6c 65 61 76 65 2e 7a 6f 6f 6d 2d 6c 65 66 74 2d 6c 65 61 76 65 2d 61 63 74 69 76 65 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 4f 75 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 4f 75 74 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 Data Ascii: t-animation-name:antZoomLeftIn;animation-name:antZoomLeftIn;-webkit-animation-play-state:running;animation-play-state:running}.zoom-left-leave.zoom-left-leave-active{-webkit-animation-name:antZoomLeftOut;animation-name:antZoomLeftOut;-webkit-animation-pla
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 3a 70 6f 69 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 63 6f 6d 6d 6f 6e 2d 66 6f 6f 74 65 72 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6c 69 6e 6b 73 2d 69 74 65 6d 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 39 31 63 31 65 7d 2e 73 75 62 73 63 72 69 62 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 73 75 62 73 63 72 69 62 65 20 2e 73 75 62 73 63 72 69 62 65 2d 69 6e 70 75 74 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 32 66 34 66 35 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 34 30 70 78 20 30 20 32 30 70 78 3b 68 65 69 67 Data Ascii: :pointer;text-decoration:none}.common-footer .nav-links .links-item a:hover{color:#191c1e}.subscribe{position:relative;margin-top:10px}.subscribe .subscribe-input{border-radius:20px;background-color:#f2f4f5;border:none;outline:0;padding:0 40px 0 20px;heig
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 6f 6e 74 61 63 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 62 66 63 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 6f 6d 65 2d 70 61 67 65 20 2e 63 6f 6e 74 61 63 74 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 6e 65 72 7b 77 69 64 74 68 3a 31 31 36 38 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 31 30 30 70 78 20 30 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 38 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 68 6f 6d 65 2d 70 61 67 65 20 2e 63 6f 6e 74 61 63 74 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 6e 65 Data Ascii: ontact{width:100%;background-color:#fafbfc;background-color:#fff}.home-page .contact .contact-inner{width:1168px;margin:0 auto;padding:100px 0;padding-top:80px;padding-bottom:60px}@media only screen and (max-width:1024px){.home-page .contact .contact-inne
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 78 29 7b 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 31 36 70 78 7d 7d 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 39 30 70 78 7d 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 72 6b 2d 70 69 63 74 75 72 65 2e 64 65 73 6b 74 6f 70 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 74 6f 6b 65 6e 6c Data Ascii: x){.tokenlon-page .work .work-title{font-size:32px;padding:0 16px}}.tokenlon-page .work .work-container{display:flex;justify-content:center;align-items:center;margin-top:90px}.tokenlon-page .work .work-container .work-picture.desktop{display:block}.tokenl
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 33 70 78 3b 74 6f 70 3a 2d 33 70 78 3b 77 69 64 74 68 3a 35 70 78 3b 68 65 69 67 68 74 3a 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 61 62 6f 75 74 2d 70 61 67 65 20 2e 65 76 65 6e 74 73 20 2e 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 20 2e 62 69 67 2d 65 76 65 6e 74 73 20 2e 65 76 65 6e 74 2d 6c 69 6e 65 20 2e 65 76 65 6e 74 2d 64 65 73 63 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 7d 2e 61 62 6f 75 74 2d 70 61 67 65 20 2e 65 76 65 6e 74 73 20 2e 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 20 2e 62 69 67 2d 65 76 65 6e 74 73 20 2e 65 76 65 6e 74 2d 6c 69 6e 65 20 2e 65 76 65 6e 74 2d 64 65 73 63 20 2e 65 76 65 6e 74 2d 74 69 74 6c 65 7b 6d 61 78 2d 77 69 64 74 68 Data Ascii: 3px;top:-3px;width:5px;height:5px;background-color:#000;border-radius:50%}.about-page .events .section-inner .big-events .event-line .event-desc{padding-left:5px}.about-page .events .section-inner .big-events .event-line .event-desc .event-title{max-width
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 6f 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6d 6d 73 6c 69 64 65 49 6e 7b 66 72 6f 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 35 25 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6d 6d 73 6c 69 64 65 4f 75 74 7b 66 72 6f 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 31 30 25 29 7d 7d 2e 6d 69 63 72 6f 6d 6f 64 61 6c 2d 73 6c 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 6d 69 63 72 6f 6d 6f 64 61 6c 2d 73 6c 69 64 65 2e 69 73 2d 6f 70 65 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 6d 69 63 72 6f 6d 6f 64 Data Ascii: o{opacity:0}}@keyframes mmslideIn{from{transform:translateY(15%)}to{transform:translateY(0)}}@keyframes mmslideOut{from{transform:translateY(0)}to{transform:translateY(-10%)}}.micromodal-slide{display:none}.micromodal-slide.is-open{display:block}.micromod
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 64 69 6e 67 3a 31 32 34 70 78 20 30 20 39 36 70 78 20 30 7d 2e 62 72 61 6e 64 2d 70 61 67 65 20 2e 64 65 73 63 2d 73 65 63 74 69 6f 6e 20 2e 64 65 73 63 2d 69 6e 6e 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 31 36 38 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 20 6e 6f 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 62 72 61 6e 64 2d 70 61 67 65 20 2e 64 65 73 63 2d 73 65 63 74 69 6f 6e 20 2e 64 65 73 63 2d 69 6e 6e 65 72 20 2e 6f 2d 64 6f 77 6e 6c 6f 61 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 Data Ascii: ding:124px 0 96px 0}.brand-page .desc-section .desc-inner{width:100%;max-width:1168px;margin:0 auto;display:flex;flex-flow:row nowrap;align-items:center;justify-content:space-between}.brand-page .desc-section .desc-inner .o-download{display:inline-block;w
2024-08-15 22:20:21 UTC	16384	IN	Data Raw: 65 72 2c 2e 61 6e 74 2d 62 74 6e 5b 64 69 73 61 62 6c 65 64 5d 3e 61 3a 6f 6e 6c 79 2d 63 68 69 6c 64 3a 3a 61 66 74 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 63 6f 6e 74 65 6e 74 3a 27 27 7d 2e 61 6e 74 2d 62 74 6e 2e 61 63 74 69 76 65 2c 2e 61 6e 74 2d 62 74 6e 3a 61 63 74 69 76 65 2c 2e 61 6e 74 2d 62 74 6e 3a 66 6f 63 75 73 2c 2e 61 6e 74 2d 62 74 6e 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 61 6e 74 2d 62 74 6e 3e 69 2c 2e 61 6e 74 2d 62 74 6e 3e 73 70 61 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d Data Ascii: er,.ant-btn[disabled]>a:only-child::after{position:absolute;top:0;right:0;bottom:0;left:0;background:0 0;content:''}.ant-btn.active,.ant-btn:active,.ant-btn:focus,.ant-btn:hover{text-decoration:none;background:#fff}.ant-btn>i,.ant-btn>span{display:inline-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:19 UTC	585	OUT	GET /images/bdTokenLogo.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:21 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:20 GMT Content-Type: image/png Content-Length: 2134 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:06 GMT ETag: "65faaa82-856" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:21 UTC	2134	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 12 08 06 00 00 00 51 8c 50 42 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 07 e4 49 44 41 54 58 c3 ed 99 79 4c 54 47 1c c7 57 f6 7c ec bd 78 b4 6a 1b 63 3d f6 40 34 a5 ad f2 de c3 92 c6 d0 a2 35 31 b6 fe e1 95 b4 e9 91 5e 1e 28 9e 78 e0 ad 45 aa 52 0f 14 ef 5b d4 8a 1c cb b2 c0 2e a7 80 28 4a 8d 6d 9a b4 56 db f4 48 d5 a8 f5 4e 85 e9 6f de 9b b7 bc 7d b0 b0 80 06 4d 7c c9 64 77 67 e6 cd f5 99 ef 6f 7e bf 59 99 ec 71 3d 5e af c2 e4 a9 1d 6c f6 9e 9f 64 2a a9 9b 66 29 af fb d8 72 ea 02 2d 7b fe 3c 7d 8f ce 59 65 37 3a cf 6c 33 ba 6a af 1b 0b 6a 91 a9 08 92 f7 1c 32 95 9c 47 e6 b2 ba ab c1 b4 61 70 44 f5 b3 58 e9 4f cc 7d 23 8d 4f fb 7c 2d fd 86 1a 8c 56 36 d2 6c a3 c3 3b 7f Data Ascii: PNGIHDRmQPBbKGDIDATXyLTGW\|xjc=@451^(xER[.(JmVHNo}M\|dwgo~Yq=^ld*f)r-{<}Ye7:l3jj2GapDXO}#O\|-V6l;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:22 UTC	578	OUT	GET /images/menu.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:23 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 198 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:10 GMT ETag: "65faaa86-c6" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:23 UTC	198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 1a 04 03 00 00 00 5b 64 51 fd 00 00 00 18 50 4c 54 45 00 00 00 36 3b 4e 36 3d 4c 36 3c 4d 36 3c 4d 36 3c 4d 36 3c 4d ff ff ff e0 ca aa 6c 00 00 00 06 74 52 4e 53 00 6c 75 77 88 e1 1b 6c 73 0b 00 00 00 01 62 4b 47 44 07 16 61 88 eb 00 00 00 23 49 44 41 54 18 d3 63 60 a0 0e 60 4d 83 81 00 06 da 00 46 63 18 10 00 f2 98 5c 60 40 81 46 f6 51 df 47 00 a9 3f 0c 39 db d5 8b 93 00 00 00 00 49 45 4e 44 ae 42 60 82 5b 5b 2a 41 54 2a 5d 38 30 30 46 46 44 43 31 44 30 32 46 34 36 43 41 38 31 35 32 46 41 30 31 32 39 44 31 37 45 41 30 Data Ascii: PNGIHDR[dQPLTE6;N6=L6<M6<M6<M6<MltRNSluwlsbKGDa#IDATc``MFc\`@FQG?9IENDB`[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49753	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:22 UTC	579	OUT	GET /images/alarm.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:23 UTC	271	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 574 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-23e" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:23 UTC	574	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 cf 50 4c 54 45 00 00 00 80 80 bf 80 aa aa 9f 9f 9f 8e aa aa 8b a2 a2 99 99 aa 92 9e aa 90 9b a6 99 99 a3 97 a1 aa 92 9b a4 91 a2 aa 97 9f a7 95 9d a6 92 9f a7 93 9d a8 94 9e a5 93 9f a6 94 9d a7 93 9e a6 94 9f a7 95 9d a5 94 9e a6 95 9f a7 94 9e a5 95 9e a6 94 9d a7 95 9e a5 94 9f a5 95 9d a6 93 9e a6 94 9e a7 95 9d a5 94 9e a6 95 9f a7 94 9e a6 94 9e a7 93 9d a6 94 9e a6 93 9e a6 94 9d a5 94 9e a5 95 9e a7 94 9e a6 94 9e a6 94 9e a7 94 9e a6 94 9e a5 95 9e a6 94 9e a6 94 9d a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 ff ff ff 11 0f 32 85 00 00 00 Data Ascii: PNGIHDRPLTE2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:22 UTC	578	OUT	GET /images/bdpg.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:23 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:23 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49751	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:22 UTC	579	OUT	GET /images/bdapk.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:23 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:23 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:23 UTC	355	OUT	GET /images/bdTokenLogo.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:24 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 2134 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:06 GMT ETag: "65faaa82-856" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:24 UTC	2134	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 12 08 06 00 00 00 51 8c 50 42 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 07 e4 49 44 41 54 58 c3 ed 99 79 4c 54 47 1c c7 57 f6 7c ec bd 78 b4 6a 1b 63 3d f6 40 34 a5 ad f2 de c3 92 c6 d0 a2 35 31 b6 fe e1 95 b4 e9 91 5e 1e 28 9e 78 e0 ad 45 aa 52 0f 14 ef 5b d4 8a 1c cb b2 c0 2e a7 80 28 4a 8d 6d 9a b4 56 db f4 48 d5 a8 f5 4e 85 e9 6f de 9b b7 bc 7d b0 b0 80 06 4d 7c c9 64 77 67 e6 cd f5 99 ef 6f 7e bf 59 99 ec 71 3d 5e af c2 e4 a9 1d 6c f6 9e 9f 64 2a a9 9b 66 29 af fb d8 72 ea 02 2d 7b fe 3c 7d 8f ce 59 65 37 3a cf 6c 33 ba 6a af 1b 0b 6a 91 a9 08 92 f7 1c 32 95 9c 47 e6 b2 ba ab c1 b4 61 70 44 f5 b3 58 e9 4f cc 7d 23 8d 4f fb 7c 2d fd 86 1a 8c 56 36 d2 6c a3 c3 3b 7f Data Ascii: PNGIHDRmQPBbKGDIDATXyLTGW\|xjc=@451^(xER[.(JmVHNo}M\|dwgo~Yq=^ld*f)r-{<}Ye7:l3jj2GapDXO}#O\|-V6l;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:23 UTC	582	OUT	GET /images/ewm_icon.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:24 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:23 GMT Content-Type: image/png Content-Length: 5040 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-13b0" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:24 UTC	5040	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 13 50 49 44 41 54 78 5e ed 9d 5d 72 13 c7 16 c7 4f 0f 15 ee 7d bb dc 15 c4 54 85 19 bf c5 3c 58 e4 0d bc 82 98 15 10 af 20 66 05 38 2b 08 ac 00 b3 82 98 15 60 bf 81 fc 10 f1 26 8d 53 15 79 05 31 6f 68 1c cf b9 d5 f2 28 e8 62 6b fa f4 c7 8c 7a a4 ff 54 a5 52 94 fb f3 7f fa d7 a7 bf d4 ad 08 1f 14 80 02 0b 15 50 d0 06 0a 40 81 c5 0a 00 10 b4 0e 28 50 a3 00 00 41 f3 80 02 00 04 6d 00 0a b8 29 00 0f e2 a6 1b 62 ad 89 02 00 64 4d 0c 8d 6a ba 29 00 40 dc 74 43 ac 35 51 00 80 ac 89 a1 51 4d 37 05 00 88 9b 6e 88 b5 26 0a 00 90 35 31 34 aa e9 a6 00 00 71 d3 0d b1 d6 44 81 c6 00 d9 dc fc 61 83 fe be fa 56 eb 58 26 ea c9 aa e8 a9 94 1a a8 ab f2 e2 4a d1 a7 b3 b3 Data Ascii: PNGIHDRXPIDATx^]rO}T<X f8+`&Sy1oh(bkzTRP@(PAm)bdMj)@tC5QQM7n&514qDaVX&J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49758	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	578	OUT	GET /generate-qrcode HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	1182	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6IjB6YUcyaU5HODhPVDRMYjNraTk1MEE9PSIsInZhbHVlIjoiY0dPVFNqNEJ4clVaMkhUWi92RVc3SVh5VWpKRk1RYkw2bFp6MElXRitCWW9xRTBSaFdhZHRTZUwrano1SEdmZS94aGpKK1ZWakR6MURjVmVNQ0tzbStSaWd4bElqeFcwTERyRzROc1hPejQ4MHpoUi9VTGFmS3hha0ZsUVZGMHciLCJtYWMiOiI0NDY0NTg5NzNlMzhiOGEyNTQ3MmQxMzgyMzY1ZGJlZDAxYjRhZjUwZmNlN2EyNDMwNzJlZDQyNzRlNTczY2JlIiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:24 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6Im8rV1l1aW5vR1AxNUp0QjkxRVJCTlE9PSIsInZhbHVlIjoiQ2xzSm5oYVBzRTQ2YS9ITlJyZG8xZ2E5U2EwdlZtbHkrblFaQ0FNRmtnd0dNT21LRDJGNlFGNmc4ekk1U1RPWDdyRWFMb2FkSTJJZFhHWjhJYy9GZURUSmplb2VoTFE0NmNGMGRqaDl0bTdiMEVKMWp4V2kxUnRqTWtNalZxVXIiLCJtYWMiOiI3NTdhMzlkZmMxYjRhYzM0ZWU2YjJmYzcwMzJmZmVlNGQwZDBkZWYyYjhkODI2ZDU3NDM4ODgwN2VlNTJjYWM1IiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:24 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-15 22:20:25 UTC	408	IN	Data Raw: 31 38 63 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 01 00 00 00 00 85 23 93 33 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 01 dd 8a 13 a4 00 00 01 19 49 44 41 54 58 c3 dd 97 5b 12 c3 20 08 45 d9 39 4b a7 1a 1e 5e 24 f9 87 3a 69 3a 7a 9c 4e 01 bd 00 91 0e 26 96 f5 c8 7a 51 1e 63 c9 7e 27 b2 37 3e db 83 e8 4a 73 62 d6 b0 9a e5 96 25 c2 ee 8a 41 24 82 52 09 13 c4 6e 16 79 b7 47 fe 83 d8 19 b5 1b a7 9f 74 7a 3b 12 d7 03 38 8f 45 29 26 12 42 5d d8 43 7c 68 f0 cc 03 7b de 99 9c 33 76 2e 57 d8 a7 24 54 7c 0c a1 62 0f 64 ab a3 87 1c 1e 69 4c 72 4a b5 47 d0 54 4b 57 3e 91 41 24 ae d2 da 12 a9 37 12 af c6 b4 37 a9 92 Data Ascii: 18cPNGIHDR#3 cHRMz&u0`:pQ<bKGDIDATX[ E9K^$:i:zN&zQc~'7>Jsb%A$RnyGtz;8E)&B]C\|h{3v.W$T\|bdiLrJGTKW>A$77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	348	OUT	GET /images/menu.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:24 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Content-Length: 198 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:10 GMT ETag: "65faaa86-c6" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:24 UTC	198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 1a 04 03 00 00 00 5b 64 51 fd 00 00 00 18 50 4c 54 45 00 00 00 36 3b 4e 36 3d 4c 36 3c 4d 36 3c 4d 36 3c 4d 36 3c 4d ff ff ff e0 ca aa 6c 00 00 00 06 74 52 4e 53 00 6c 75 77 88 e1 1b 6c 73 0b 00 00 00 01 62 4b 47 44 07 16 61 88 eb 00 00 00 23 49 44 41 54 18 d3 63 60 a0 0e 60 4d 83 81 00 06 da 00 46 63 18 10 00 f2 98 5c 60 40 81 46 f6 51 df 47 00 a9 3f 0c 39 db d5 8b 93 00 00 00 00 49 45 4e 44 ae 42 60 82 5b 5b 2a 41 54 2a 5d 38 30 30 46 46 44 43 31 44 30 32 46 34 36 43 41 38 31 35 32 46 41 30 31 32 39 44 31 37 45 41 30 Data Ascii: PNGIHDR[dQPLTE6;N6=L6<M6<M6<M6<MltRNSluwlsbKGDa#IDATc``MFc\`@FQG?9IENDB`[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49756	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	583	OUT	GET /images/app-store.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:24 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:03 GMT ETag: "65faaa7f-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:24 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	348	OUT	GET /images/bdpg.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	580	OUT	GET /images/apk-zh.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	585	OUT	GET /images/google-play.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:24 GMT Content-Type: image/png Content-Length: 3103 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-c1f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	3103	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 88 00 00 00 28 08 06 00 00 00 25 a6 b2 bc 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 0b ad 49 44 41 54 78 da ed 9c 07 50 14 c9 1a c7 77 c9 41 cc 39 e7 80 22 e6 f4 4c 9c 09 ef 50 3c b5 cc 96 e1 99 43 a9 04 b5 cc 9e a5 67 4e 18 aa 0c e5 b3 e4 99 73 ce fa cc 98 9e 8a a0 22 7a 26 4c a7 9e 3e b3 32 fc df fc fb ec 71 76 59 10 15 0e 4f e6 ab fa 8a 9d de de 99 de 9e df 74 7f 89 35 99 3e ca 3f 54 dd a2 ea 13 55 61 68 9a d3 97 aa 1e 51 b5 9d c9 86 f4 54 35 d6 98 24 43 3f e8 22 55 cd 12 8e f2 06 1c 86 da d0 ee 12 90 25 c6 64 18 6a 43 2f 4b 40 22 8c c9 30 34 01 f5 20 20 37 8d 89 30 34 01 cd f3 b7 02 24 7b f6 ec f0 f5 f5 45 a6 4c 99 b4 b6 ac 59 b3 a2 78 f1 e2 9a 7a 78 78 58 1c 17 2d 5a 54 eb eb Data Ascii: PNGIHDR(%bKGDIDATxPwA9"LP<CgNs"z&L>2qvYOt5>?TUahQT5$C?"U%djC/K@"04 704${ELYxzxxX-ZT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49761	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	349	OUT	GET /images/alarm.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	271	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:25 GMT Content-Type: image/png Content-Length: 574 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-23e" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	574	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 cf 50 4c 54 45 00 00 00 80 80 bf 80 aa aa 9f 9f 9f 8e aa aa 8b a2 a2 99 99 aa 92 9e aa 90 9b a6 99 99 a3 97 a1 aa 92 9b a4 91 a2 aa 97 9f a7 95 9d a6 92 9f a7 93 9d a8 94 9e a5 93 9f a6 94 9d a7 93 9e a6 94 9f a7 95 9d a5 94 9e a6 95 9f a7 94 9e a5 95 9e a6 94 9d a7 95 9e a5 94 9f a5 95 9d a6 93 9e a6 94 9e a7 95 9d a5 94 9e a6 95 9f a7 94 9e a6 94 9e a7 93 9d a6 94 9e a6 93 9e a6 94 9d a5 94 9e a5 95 9e a7 94 9e a6 94 9e a6 94 9e a7 94 9e a6 94 9e a5 95 9e a6 94 9e a6 94 9d a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 ff ff ff 11 0f 32 85 00 00 00 Data Ascii: PNGIHDRPLTE2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	580	OUT	GET /images/banner.png HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:25 GMT Content-Type: image/png Content-Length: 46217 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:04 GMT ETag: "65faaa80-b489" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	16087	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 e8 00 00 03 e8 08 03 00 00 00 7a 7d 24 d6 00 00 02 fa 50 4c 54 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 06 92 c3 fb fb fc f9 f9 fa 47 40 6a 30 32 46 42 c6 67 2a 80 ea fa c1 66 e2 69 61 3c c6 8a fa fb fb fc fc fd f9 f9 fc f7 f8 fc fd fd fe f7 f8 fa 00 00 00 f9 fa fd 39 a6 d0 63 d1 a1 e8 87 81 f4 f5 fb f1 f3 fa 1f 1f 1f fb fc fe fb cd 85 6c 66 88 55 99 ee 59 5b 6b 68 d1 85 f5 f6 fb 2b a2 cc cc cc cc ee f1 f9 43 45 4f 7d 7d 7d 59 cf 9c 5e cf 7e fb ca 7d 4a 93 ed c9 ca ca ef ef f0 63 5d 80 4f 51 62 e6 80 79 f2 f3 f4 a8 a8 b5 df df e0 ed ed ef d9 d9 da ef f1 f4 f4 f4 f6 f4 f5 f8 e8 e8 ea e1 e2 e4 f4 b7 31 f6 f7 f8 60 b9 d8 27 75 ca b5 Data Ascii: PNGIHDRz}$PLTEG@j02FBg*fia<9clfUY[kh+CEO}}}Y^~}Jc]OQby1`'u
2024-08-15 22:20:26 UTC	16384	IN	Data Raw: af c8 1b 00 5e ca eb 23 b9 2d 8c b0 0d 67 87 38 51 77 49 11 80 ec 91 ae 7b ce 31 bf 46 4b 53 40 cd 68 06 bb ee 4d 80 68 16 b1 6d 02 68 0a 83 69 64 65 5f 1c 88 4d 39 f8 d8 75 36 b7 40 39 f8 16 29 7a 7c c3 cc 69 17 fd d2 9f 8a 1e 1d 8c 13 33 72 03 0e 79 5d 5d b8 6c 9a cb 95 b6 6a ce ce ea fc cb 4a c6 54 af 63 cd 34 33 cf 6e a8 99 24 f0 4c be b7 3c 77 5b 57 33 95 b6 69 e6 47 41 37 01 23 38 cd 90 6c 5b 33 2c 82 ef ec 9d 4d 6b 13 41 18 c7 55 14 94 87 2e 81 c0 64 98 78 13 c1 83 8c 50 2c 12 1b 5b 5b f6 60 89 c5 57 50 63 a3 d8 10 57 83 b6 0a cd a1 3d b4 a5 34 f4 56 0f 5b 2c 18 a8 c5 52 d4 de 8b 5e 2a 5e 4a af bd 7a 29 81 7e 03 3f 81 b3 2f 76 93 75 b3 9b d4 84 66 36 cf af 69 d3 dd ae 39 08 3f 9e ff 3e 33 b3 d3 27 1a 6c 5b 46 ef cd 69 c6 2d 6e 89 13 fd 42 ed 8f da Data Ascii: ^#-g8QwI{1FKS@hMhmhide_M9u6@9)z\|i3ry]]ljJTc43n$L<w[W3iGA7#8l[3,MkAU.dxP,[[`WPcW=4V[,R^*^Jz)~?/vuf6i9?>3'l[Fi-nB
2024-08-15 22:20:26 UTC	13746	IN	Data Raw: e4 77 20 51 14 c9 47 07 d1 c7 69 2d 1e 15 1d 3e f3 a5 77 97 45 ff f7 33 dc 5f 74 7b b0 96 ae f7 5e 5b 18 f7 5e e3 3d d2 27 d3 88 43 29 0a 09 fa 6b 8c 6c 8b 40 40 db 69 f2 7a 1c 85 c6 0a 00 2c 1d 87 81 11 3d 16 21 be 75 ab 34 55 f2 2a 7a b0 25 13 e3 03 57 fd 6e 0c 6e 15 ce 1f d0 4d 55 05 4b f5 05 7b 37 55 e0 dd 54 6f 43 ba 20 94 a2 23 8d b7 c3 5b 8d 1d 09 d4 42 15 0c b6 56 20 56 10 01 d2 45 11 4c 02 c5 97 00 2b a5 74 a3 91 40 4e db 6b d6 91 19 4f 2e c6 31 3e fd 17 e2 23 78 17 44 0f fd fb e1 13 58 b8 d3 1f 1d 8d fa a3 23 de 1f fd 96 48 ab c7 bf 8d b4 dd f9 a5 b1 13 6b 14 84 48 41 06 83 f5 92 61 f5 71 21 5f 50 81 b1 53 00 40 5b c7 a5 58 fa b8 84 9c 8e c0 52 44 4f 9e 8c e3 3c 02 2e 88 0e a8 2a 23 87 bb 2d 19 38 8e 68 8d 62 be 21 80 41 a2 34 03 20 14 d3 63 d1 Data Ascii: w QGi->wE3_t{^[^='C)kl@@iz,=!u4Uz%WnnMUK{7UToC #[BV VEL+t@NkO.1>#xDX#HkHAaq!_PS@[XRDO<.#-8hb!A4 c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:24 UTC	349	OUT	GET /images/bdapk.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:25 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:25 UTC	352	OUT	GET /images/ewm_icon.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:25 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:25 GMT Content-Type: image/png Content-Length: 5040 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-13b0" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:25 UTC	5040	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 13 50 49 44 41 54 78 5e ed 9d 5d 72 13 c7 16 c7 4f 0f 15 ee 7d bb dc 15 c4 54 85 19 bf c5 3c 58 e4 0d bc 82 98 15 10 af 20 66 05 38 2b 08 ac 00 b3 82 98 15 60 bf 81 fc 10 f1 26 8d 53 15 79 05 31 6f 68 1c cf b9 d5 f2 28 e8 62 6b fa f4 c7 8c 7a a4 ff 54 a5 52 94 fb f3 7f fa d7 a7 bf d4 ad 08 1f 14 80 02 0b 15 50 d0 06 0a 40 81 c5 0a 00 10 b4 0e 28 50 a3 00 00 41 f3 80 02 00 04 6d 00 0a b8 29 00 0f e2 a6 1b 62 ad 89 02 00 64 4d 0c 8d 6a ba 29 00 40 dc 74 43 ac 35 51 00 80 ac 89 a1 51 4d 37 05 00 88 9b 6e 88 b5 26 0a 00 90 35 31 34 aa e9 a6 00 00 71 d3 0d b1 d6 44 81 c6 00 d9 dc fc 61 83 fe be fa 56 eb 58 26 ea c9 aa e8 a9 94 1a a8 ab f2 e2 4a d1 a7 b3 b3 Data Ascii: PNGIHDRXPIDATx^]rO}T<X f8+`&Sy1oh(bkzTRP@(PAm)bdMj)@tC5QQM7n&514qDaVX&J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49768	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:26 UTC	353	OUT	GET /images/app-store.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:26 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:26 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:03 GMT ETag: "65faaa7f-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:26 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:26 UTC	348	OUT	GET /generate-qrcode HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:26 UTC	1182	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:26 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6InEyQ21jek5Tc1BjbVJvcTlUTmJVMlE9PSIsInZhbHVlIjoiT2Z5Y3U4Wkdieng5ZTFjdWlvMEJJUXZEclNpVDByeS9QS29VU09pTnJTZGFVTUFqa3h5cG5PRENxc0JvN1lXWDBiK1FEenhjUU1LdUNKV0ZyVDFEbmU3NkxIS2JWREtiays2eHpXTnZWbENHUWFzZnVCQUdOeEJYMTVKNk5oa2EiLCJtYWMiOiI4Yjg1ODg3NWFiYTY0OTUxNGRmMzhkYzhiNTY5MzUzZGM1YTk4NTk5Yjc3MjQ2ODU5MmJlYzE0YzhmMDQyYjIxIiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:26 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6IkhUZzU5MEJtb1c5TVh0Vk5peGlWanc9PSIsInZhbHVlIjoiVytSNy9ReXp5bzBId1VpSnNqZjU4eVRjM1JFcDhueFVDTUVXMThTMlJSQXVFcnZrQjlzUk03TGJIajh1eDBGZ1psKzhsZ0F4NFlNS2tYSkJSNXcvU01Wb2JBME14RWs4c2hqUlpIYVJYOGsvclVTR1AxZDJGb1RkZjlNZlM0S28iLCJtYWMiOiIzOTFkZjhhMjFlNzI0NTBjNzNkMGYyNjRlYmIxZWZjYjkxMjM5YmU0Njg0NmUwMTEyYTAzNjg0NjA5NjlkYmMyIiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:26 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-15 22:20:26 UTC	408	IN	Data Raw: 31 38 63 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 01 00 00 00 00 85 23 93 33 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 01 dd 8a 13 a4 00 00 01 19 49 44 41 54 58 c3 dd 97 5b 12 c3 20 08 45 d9 39 4b a7 1a 1e 5e 24 f9 87 3a 69 3a 7a 9c 4e 01 bd 00 91 0e 26 96 f5 c8 7a 51 1e 63 c9 7e 27 b2 37 3e db 83 e8 4a 73 62 d6 b0 9a e5 96 25 c2 ee 8a 41 24 82 52 09 13 c4 6e 16 79 b7 47 fe 83 d8 19 b5 1b a7 9f 74 7a 3b 12 d7 03 38 8f 45 29 26 12 42 5d d8 43 7c 68 f0 cc 03 7b de 99 9c 33 76 2e 57 d8 a7 24 54 7c 0c a1 62 0f 64 ab a3 87 1c 1e 69 4c 72 4a b5 47 d0 54 4b 57 3e 91 41 24 ae d2 da 12 a9 37 12 af c6 b4 37 a9 92 Data Ascii: 18cPNGIHDR#3 cHRMz&u0`:pQ<bKGDIDATX[ E9K^$:i:zN&zQc~'7>Jsb%A$RnyGtz;8E)&B]C\|h{3v.W$T\|bdiLrJGTKW>A$77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49767	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:26 UTC	355	OUT	GET /images/google-play.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:26 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:26 GMT Content-Type: image/png Content-Length: 3103 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-c1f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:26 UTC	3103	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 88 00 00 00 28 08 06 00 00 00 25 a6 b2 bc 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 0b ad 49 44 41 54 78 da ed 9c 07 50 14 c9 1a c7 77 c9 41 cc 39 e7 80 22 e6 f4 4c 9c 09 ef 50 3c b5 cc 96 e1 99 43 a9 04 b5 cc 9e a5 67 4e 18 aa 0c e5 b3 e4 99 73 ce fa cc 98 9e 8a a0 22 7a 26 4c a7 9e 3e b3 32 fc df fc fb ec 71 76 59 10 15 0e 4f e6 ab fa 8a 9d de de 99 de 9e df 74 7f 89 35 99 3e ca 3f 54 dd a2 ea 13 55 61 68 9a d3 97 aa 1e 51 b5 9d c9 86 f4 54 35 d6 98 24 43 3f e8 22 55 cd 12 8e f2 06 1c 86 da d0 ee 12 90 25 c6 64 18 6a 43 2f 4b 40 22 8c c9 30 34 01 f5 20 20 37 8d 89 30 34 01 cd f3 b7 02 24 7b f6 ec f0 f5 f5 45 a6 4c 99 b4 b6 ac 59 b3 a2 78 f1 e2 9a 7a 78 78 58 1c 17 2d 5a 54 eb eb Data Ascii: PNGIHDR(%bKGDIDATxPwA9"LP<CgNs"z&L>2qvYOt5>?TUahQT5$C?"U%djC/K@"04 704${ELYxzxxX-ZT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:26 UTC	350	OUT	GET /images/apk-zh.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:26 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:26 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:26 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49773	188.114.96.3	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:27 UTC	572	OUT	GET /favicon.ico HTTP/1.1 Host: im20.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im20.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:27 UTC	590	IN	HTTP/1.1 404 Not Found Date: Thu, 15 Aug 2024 22:20:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b3c926f8941429a-EWR alt-svc: h3=":443"; ma=86400
2024-08-15 22:20:27 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-08-15 22:20:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49775	35.190.80.1	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:28 UTC	523	OUT	OPTIONS /report/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://im20.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:28 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 15 Aug 2024 22:20:28 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49779	35.190.80.1	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:29 UTC	472	OUT	POST /report/v4?s=D74C6Ri2hcbzlYWO1zMF%2BrbjBmGz63w4gDy%2BBGGAkQ05B19VmPL97482QRGUWGn8fQu3ifqFvdBLrySnMKyMDYO7e%2BEyd4I7qM28Q5MjepusBMPitn2xdhem2A%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 406 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-15 22:20:29 UTC	406	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 31 37 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6d 32 30 2e 6e 65 74 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f Data Ascii: [{"age":0,"body":{"elapsed_time":1176,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://im20.net/","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":404,"type":"http.error"},"type":"network-error","url":"https:/
2024-08-15 22:20:29 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 15 Aug 2024 22:20:28 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49778	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:29 UTC	1073	OUT	GET /images/banner.png HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InEyQ21jek5Tc1BjbVJvcTlUTmJVMlE9PSIsInZhbHVlIjoiT2Z5Y3U4Wkdieng5ZTFjdWlvMEJJUXZEclNpVDByeS9QS29VU09pTnJTZGFVTUFqa3h5cG5PRENxc0JvN1lXWDBiK1FEenhjUU1LdUNKV0ZyVDFEbmU3NkxIS2JWREtiays2eHpXTnZWbENHUWFzZnVCQUdOeEJYMTVKNk5oa2EiLCJtYWMiOiI4Yjg1ODg3NWFiYTY0OTUxNGRmMzhkYzhiNTY5MzUzZGM1YTk4NTk5Yjc3MjQ2ODU5MmJlYzE0YzhmMDQyYjIxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkhUZzU5MEJtb1c5TVh0Vk5peGlWanc9PSIsInZhbHVlIjoiVytSNy9ReXp5bzBId1VpSnNqZjU4eVRjM1JFcDhueFVDTUVXMThTMlJSQXVFcnZrQjlzUk03TGJIajh1eDBGZ1psKzhsZ0F4NFlNS2tYSkJSNXcvU01Wb2JBME14RWs4c2hqUlpIYVJYOGsvclVTR1AxZDJGb1RkZjlNZlM0S28iLCJtYWMiOiIzOTFkZjhhMjFlNzI0NTBjNzNkMGYyNjRlYmIxZWZjYjkxMjM5YmU0Njg0NmUwMTEyYTAzNjg0NjA5NjlkYmMyIiwidGFnIjoiIn0%3D
2024-08-15 22:20:30 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:29 GMT Content-Type: image/png Content-Length: 46217 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:04 GMT ETag: "65faaa80-b489" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:30 UTC	16087	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 e8 00 00 03 e8 08 03 00 00 00 7a 7d 24 d6 00 00 02 fa 50 4c 54 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 06 92 c3 fb fb fc f9 f9 fa 47 40 6a 30 32 46 42 c6 67 2a 80 ea fa c1 66 e2 69 61 3c c6 8a fa fb fb fc fc fd f9 f9 fc f7 f8 fc fd fd fe f7 f8 fa 00 00 00 f9 fa fd 39 a6 d0 63 d1 a1 e8 87 81 f4 f5 fb f1 f3 fa 1f 1f 1f fb fc fe fb cd 85 6c 66 88 55 99 ee 59 5b 6b 68 d1 85 f5 f6 fb 2b a2 cc cc cc cc ee f1 f9 43 45 4f 7d 7d 7d 59 cf 9c 5e cf 7e fb ca 7d 4a 93 ed c9 ca ca ef ef f0 63 5d 80 4f 51 62 e6 80 79 f2 f3 f4 a8 a8 b5 df df e0 ed ed ef d9 d9 da ef f1 f4 f4 f4 f6 f4 f5 f8 e8 e8 ea e1 e2 e4 f4 b7 31 f6 f7 f8 60 b9 d8 27 75 ca b5 Data Ascii: PNGIHDRz}$PLTEG@j02FBg*fia<9clfUY[kh+CEO}}}Y^~}Jc]OQby1`'u
2024-08-15 22:20:30 UTC	16384	IN	Data Raw: af c8 1b 00 5e ca eb 23 b9 2d 8c b0 0d 67 87 38 51 77 49 11 80 ec 91 ae 7b ce 31 bf 46 4b 53 40 cd 68 06 bb ee 4d 80 68 16 b1 6d 02 68 0a 83 69 64 65 5f 1c 88 4d 39 f8 d8 75 36 b7 40 39 f8 16 29 7a 7c c3 cc 69 17 fd d2 9f 8a 1e 1d 8c 13 33 72 03 0e 79 5d 5d b8 6c 9a cb 95 b6 6a ce ce ea fc cb 4a c6 54 af 63 cd 34 33 cf 6e a8 99 24 f0 4c be b7 3c 77 5b 57 33 95 b6 69 e6 47 41 37 01 23 38 cd 90 6c 5b 33 2c 82 ef ec 9d 4d 6b 13 41 18 c7 55 14 94 87 2e 81 c0 64 98 78 13 c1 83 8c 50 2c 12 1b 5b 5b f6 60 89 c5 57 50 63 a3 d8 10 57 83 b6 0a cd a1 3d b4 a5 34 f4 56 0f 5b 2c 18 a8 c5 52 d4 de 8b 5e 2a 5e 4a af bd 7a 29 81 7e 03 3f 81 b3 2f 76 93 75 b3 9b d4 84 66 36 cf af 69 d3 dd ae 39 08 3f 9e ff 3e 33 b3 d3 27 1a 6c 5b 46 ef cd 69 c6 2d 6e 89 13 fd 42 ed 8f da Data Ascii: ^#-g8QwI{1FKS@hMhmhide_M9u6@9)z\|i3ry]]ljJTc43n$L<w[W3iGA7#8l[3,MkAU.dxP,[[`WPcW=4V[,R^*^Jz)~?/vuf6i9?>3'l[Fi-nB
2024-08-15 22:20:30 UTC	13746	IN	Data Raw: e4 77 20 51 14 c9 47 07 d1 c7 69 2d 1e 15 1d 3e f3 a5 77 97 45 ff f7 33 dc 5f 74 7b b0 96 ae f7 5e 5b 18 f7 5e e3 3d d2 27 d3 88 43 29 0a 09 fa 6b 8c 6c 8b 40 40 db 69 f2 7a 1c 85 c6 0a 00 2c 1d 87 81 11 3d 16 21 be 75 ab 34 55 f2 2a 7a b0 25 13 e3 03 57 fd 6e 0c 6e 15 ce 1f d0 4d 55 05 4b f5 05 7b 37 55 e0 dd 54 6f 43 ba 20 94 a2 23 8d b7 c3 5b 8d 1d 09 d4 42 15 0c b6 56 20 56 10 01 d2 45 11 4c 02 c5 97 00 2b a5 74 a3 91 40 4e db 6b d6 91 19 4f 2e c6 31 3e fd 17 e2 23 78 17 44 0f fd fb e1 13 58 b8 d3 1f 1d 8d fa a3 23 de 1f fd 96 48 ab c7 bf 8d b4 dd f9 a5 b1 13 6b 14 84 48 41 06 83 f5 92 61 f5 71 21 5f 50 81 b1 53 00 40 5b c7 a5 58 fa b8 84 9c 8e c0 52 44 4f 9e 8c e3 3c 02 2e 88 0e a8 2a 23 87 bb 2d 19 38 8e 68 8d 62 be 21 80 41 a2 34 03 20 14 d3 63 d1 Data Ascii: w QGi->wE3_t{^[^='C)kl@@iz,=!u4Uz%WnnMUK{7UToC #[BV VEL+t@NkO.1>#xDX#HkHAaq!_PS@[XRDO<.#-8hb!A4 c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49781	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:40 UTC	1368	OUT	GET /download.html HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6InEyQ21jek5Tc1BjbVJvcTlUTmJVMlE9PSIsInZhbHVlIjoiT2Z5Y3U4Wkdieng5ZTFjdWlvMEJJUXZEclNpVDByeS9QS29VU09pTnJTZGFVTUFqa3h5cG5PRENxc0JvN1lXWDBiK1FEenhjUU1LdUNKV0ZyVDFEbmU3NkxIS2JWREtiays2eHpXTnZWbENHUWFzZnVCQUdOeEJYMTVKNk5oa2EiLCJtYWMiOiI4Yjg1ODg3NWFiYTY0OTUxNGRmMzhkYzhiNTY5MzUzZGM1YTk4NTk5Yjc3MjQ2ODU5MmJlYzE0YzhmMDQyYjIxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkhUZzU5MEJtb1c5TVh0Vk5peGlWanc9PSIsInZhbHVlIjoiVytSNy9ReXp5bzBId1VpSnNqZjU4eVRjM1JFcDhueFVDTUVXMThTMlJSQXVFcnZrQjlzUk03TGJIajh1eDBGZ1psKzhsZ0F4NFlNS2tYSkJSNXcvU01Wb2JBME14RWs4c2hqUlpIYVJYOGsvclVTR1AxZDJGb1RkZjlNZlM0S28iLCJtYWMiOiIzOTFkZjhhMjFlNzI0NTBjNzNkMGYyNjRlYmIxZWZjYjkxMjM5YmU0Njg0NmUwMTEyYTAzNjg0NjA5NjlkYmMyIiwidGFnIjoiIn0%3D
2024-08-15 22:20:41 UTC	1197	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6IkFCQk1FWlpiRFM2NGFpZmg3NSticlE9PSIsInZhbHVlIjoiVzBCS3lmYXFodmx2QnR2dmkrN3RaQTFwMmoyenhmZTNUOFBHTjRzc25YT0Z1aUxVTjdHZGQ1cks5UHhOWUZ3bzVNTGdvTGxTWW1SZjRUSFR4SGdVTnhlUmdzYWdmY1hZa0NLVk9CREI5NW9oQ1RGb0JzK3F1YlpmMjVLUjMzYWoiLCJtYWMiOiI4YzQ5YTg2NWE3NzllM2M5YjcwODA2Mzg5MGQ0YTYyZGRiZjEwMWFkMjg0Y2ViMDJhZGMxZjBkMjU5OWE2Y2RmIiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:40 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6ImozaVk0THR6ZFVqNEQwaFBnOEVOV1E9PSIsInZhbHVlIjoiNVNYWWlpdjdwT2hpeUFTV24zcTBsOEMrUVNYRGpyVjNxUUxvMW1PanFhTU9uZEFPUng1Q2FxMGd1VWFiR0x5RExuT1ZyWFZKblMyWGNmbkliNW02anNzTHVGMmFwQUVDVHN1aFdhTlU0S3U1c3pqM2ZNQ0d0TVVrb1NBL3k1cG8iLCJtYWMiOiI0ODc1NTZiMDJlMjRmNDNlODU1MTEwMjA1ODMxOGYyOTU2MDk3MWNkZDY0MDExZDgyNTMwOTYxZDNkOGI1MTFkIiwidGFnIjoiIn0%3D; expires=Fri, 16 Aug 2024 00:20:40 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-15 22:20:41 UTC	428	IN	Data Raw: 31 61 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 bd 91 e7 ab 99 e5 bb ba e8 ae be e4 b8 ad 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e Data Ascii: 1a0<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title></title> <lin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49782	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:41 UTC	1310	OUT	GET /favicon.ico HTTP/1.1 Host: im142.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im142.mom/download.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkFCQk1FWlpiRFM2NGFpZmg3NSticlE9PSIsInZhbHVlIjoiVzBCS3lmYXFodmx2QnR2dmkrN3RaQTFwMmoyenhmZTNUOFBHTjRzc25YT0Z1aUxVTjdHZGQ1cks5UHhOWUZ3bzVNTGdvTGxTWW1SZjRUSFR4SGdVTnhlUmdzYWdmY1hZa0NLVk9CREI5NW9oQ1RGb0JzK3F1YlpmMjVLUjMzYWoiLCJtYWMiOiI4YzQ5YTg2NWE3NzllM2M5YjcwODA2Mzg5MGQ0YTYyZGRiZjEwMWFkMjg0Y2ViMDJhZGMxZjBkMjU5OWE2Y2RmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImozaVk0THR6ZFVqNEQwaFBnOEVOV1E9PSIsInZhbHVlIjoiNVNYWWlpdjdwT2hpeUFTV24zcTBsOEMrUVNYRGpyVjNxUUxvMW1PanFhTU9uZEFPUng1Q2FxMGd1VWFiR0x5RExuT1ZyWFZKblMyWGNmbkliNW02anNzTHVGMmFwQUVDVHN1aFdhTlU0S3U1c3pqM2ZNQ0d0TVVrb1NBL3k1cG8iLCJtYWMiOiI0ODc1NTZiMDJlMjRmNDNlODU1MTEwMjA1ODMxOGYyOTU2MDk3MWNkZDY0MDExZDgyNTMwOTYxZDNkOGI1MTFkIiwidGFnIjoiIn0%3D
2024-08-15 22:20:41 UTC	276	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:41 GMT Content-Type: image/x-icon Content-Length: 4286 Connection: close Last-Modified: Sun, 31 Mar 2024 05:56:56 GMT ETag: "6608fb28-10be" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:41 UTC	4286	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 b0 69 01 00 ad 88 02 00 b0 69 01 0f b0 6a 02 41 b0 6b 02 86 b1 6c 02 ba b1 6e 02 dd b2 6f 02 ef b2 70 03 f9 b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 77 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 7f 05 ff b8 80 05 ff b9 82 05 ff b9 83 06 ff ba 85 06 fe ba 86 06 fc bb 88 07 f7 bc 8a 07 ee bc 8b 07 da bd 8d 08 b8 be 8f 08 85 be 90 08 40 be 91 08 0e b4 80 00 00 be 93 08 00 b2 5e 01 00 b0 69 01 13 b0 6a 01 57 b0 6a 01 ae b0 6b 02 e1 b1 6d 02 f1 b2 6f 02 f8 b2 70 02 fc b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 76 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 Data Ascii: ( @ iijAklnoprsuwxz{}@^ijWjkmoprsuvxz{}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49783	8.218.143.165	443	5460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 22:20:42 UTC	1067	OUT	GET /favicon.ico HTTP/1.1 Host: im142.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkFCQk1FWlpiRFM2NGFpZmg3NSticlE9PSIsInZhbHVlIjoiVzBCS3lmYXFodmx2QnR2dmkrN3RaQTFwMmoyenhmZTNUOFBHTjRzc25YT0Z1aUxVTjdHZGQ1cks5UHhOWUZ3bzVNTGdvTGxTWW1SZjRUSFR4SGdVTnhlUmdzYWdmY1hZa0NLVk9CREI5NW9oQ1RGb0JzK3F1YlpmMjVLUjMzYWoiLCJtYWMiOiI4YzQ5YTg2NWE3NzllM2M5YjcwODA2Mzg5MGQ0YTYyZGRiZjEwMWFkMjg0Y2ViMDJhZGMxZjBkMjU5OWE2Y2RmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImozaVk0THR6ZFVqNEQwaFBnOEVOV1E9PSIsInZhbHVlIjoiNVNYWWlpdjdwT2hpeUFTV24zcTBsOEMrUVNYRGpyVjNxUUxvMW1PanFhTU9uZEFPUng1Q2FxMGd1VWFiR0x5RExuT1ZyWFZKblMyWGNmbkliNW02anNzTHVGMmFwQUVDVHN1aFdhTlU0S3U1c3pqM2ZNQ0d0TVVrb1NBL3k1cG8iLCJtYWMiOiI0ODc1NTZiMDJlMjRmNDNlODU1MTEwMjA1ODMxOGYyOTU2MDk3MWNkZDY0MDExZDgyNTMwOTYxZDNkOGI1MTFkIiwidGFnIjoiIn0%3D
2024-08-15 22:20:43 UTC	276	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 15 Aug 2024 22:20:43 GMT Content-Type: image/x-icon Content-Length: 4286 Connection: close Last-Modified: Sun, 31 Mar 2024 05:56:56 GMT ETag: "6608fb28-10be" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-15 22:20:43 UTC	4286	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 b0 69 01 00 ad 88 02 00 b0 69 01 0f b0 6a 02 41 b0 6b 02 86 b1 6c 02 ba b1 6e 02 dd b2 6f 02 ef b2 70 03 f9 b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 77 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 7f 05 ff b8 80 05 ff b9 82 05 ff b9 83 06 ff ba 85 06 fe ba 86 06 fc bb 88 07 f7 bc 8a 07 ee bc 8b 07 da bd 8d 08 b8 be 8f 08 85 be 90 08 40 be 91 08 0e b4 80 00 00 be 93 08 00 b2 5e 01 00 b0 69 01 13 b0 6a 01 57 b0 6a 01 ae b0 6b 02 e1 b1 6d 02 f1 b2 6f 02 f8 b2 70 02 fc b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 76 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 Data Ascii: ( @ iijAklnoprsuwxz{}@^ijWjkmoprsuvxz{}

Target ID:	0
Start time:	18:20:05
Start date:	15/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:20:09
Start date:	15/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2044,i,15425770461339576517,7441177578250678950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:20:11
Start date:	15/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://im20.net/"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:56212 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: im20.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jstz/imdx.js HTTP/1.1Host: tretwq.oss-accelerate.aliyuncs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://im20.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://im20.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /jstz/imdx.js HTTP/1.1Host: tretwq.oss-accelerate.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/swiper.min.css HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ccc8.css HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/111f.css HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdTokenLogo.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/menu.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/alarm.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdpg.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdapk.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdTokenLogo.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ewm_icon.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate-qrcode HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/menu.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/app-store.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdpg.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/apk-zh.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/google-play.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/alarm.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/banner.png HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdapk.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ewm_icon.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/app-store.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate-qrcode HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/google-play.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/apk-zh.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im20.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im20.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/banner.png HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InEyQ21jek5Tc1BjbVJvcTlUTmJVMlE9PSIsInZhbHVlIjoiT2Z5Y3U4Wkdieng5ZTFjdWlvMEJJUXZEclNpVDByeS9QS29VU09pTnJTZGFVTUFqa3h5cG5PRENxc0JvN1lXWDBiK1FEenhjUU1LdUNKV0ZyVDFEbmU3NkxIS2JWREtiays2eHpXTnZWbENHUWFzZnVCQUdOeEJYMTVKNk5oa2EiLCJtYWMiOiI4Yjg1ODg3NWFiYTY0OTUxNGRmMzhkYzhiNTY5MzUzZGM1YTk4NTk5Yjc3MjQ2ODU5MmJlYzE0YzhmMDQyYjIxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkhUZzU5MEJtb1c5TVh0Vk5peGlWanc9PSIsInZhbHVlIjoiVytSNy9ReXp5bzBId1VpSnNqZjU4eVRjM1JFcDhueFVDTUVXMThTMlJSQXVFcnZrQjlzUk03TGJIajh1eDBGZ1psKzhsZ0F4NFlNS2tYSkJSNXcvU01Wb2JBME14RWs4c2hqUlpIYVJYOGsvclVTR1AxZDJGb1RkZjlNZlM0S28iLCJtYWMiOiIzOTFkZjhhMjFlNzI0NTBjNzNkMGYyNjRlYmIxZWZjYjkxMjM5YmU0Njg0NmUwMTEyYTAzNjg0NjA5NjlkYmMyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /download.html HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InEyQ21jek5Tc1BjbVJvcTlUTmJVMlE9PSIsInZhbHVlIjoiT2Z5Y3U4Wkdieng5ZTFjdWlvMEJJUXZEclNpVDByeS9QS29VU09pTnJTZGFVTUFqa3h5cG5PRENxc0JvN1lXWDBiK1FEenhjUU1LdUNKV0ZyVDFEbmU3NkxIS2JWREtiays2eHpXTnZWbENHUWFzZnVCQUdOeEJYMTVKNk5oa2EiLCJtYWMiOiI4Yjg1ODg3NWFiYTY0OTUxNGRmMzhkYzhiNTY5MzUzZGM1YTk4NTk5Yjc3MjQ2ODU5MmJlYzE0YzhmMDQyYjIxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkhUZzU5MEJtb1c5TVh0Vk5peGlWanc9PSIsInZhbHVlIjoiVytSNy9ReXp5bzBId1VpSnNqZjU4eVRjM1JFcDhueFVDTUVXMThTMlJSQXVFcnZrQjlzUk03TGJIajh1eDBGZ1psKzhsZ0F4NFlNS2tYSkJSNXcvU01Wb2JBME14RWs4c2hqUlpIYVJYOGsvclVTR1AxZDJGb1RkZjlNZlM0S28iLCJtYWMiOiIzOTFkZjhhMjFlNzI0NTBjNzNkMGYyNjRlYmIxZWZjYjkxMjM5YmU0Njg0NmUwMTEyYTAzNjg0NjA5NjlkYmMyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im142.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im142.mom/download.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkFCQk1FWlpiRFM2NGFpZmg3NSticlE9PSIsInZhbHVlIjoiVzBCS3lmYXFodmx2QnR2dmkrN3RaQTFwMmoyenhmZTNUOFBHTjRzc25YT0Z1aUxVTjdHZGQ1cks5UHhOWUZ3bzVNTGdvTGxTWW1SZjRUSFR4SGdVTnhlUmdzYWdmY1hZa0NLVk9CREI5NW9oQ1RGb0JzK3F1YlpmMjVLUjMzYWoiLCJtYWMiOiI4YzQ5YTg2NWE3NzllM2M5YjcwODA2Mzg5MGQ0YTYyZGRiZjEwMWFkMjg0Y2ViMDJhZGMxZjBkMjU5OWE2Y2RmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImozaVk0THR6ZFVqNEQwaFBnOEVOV1E9PSIsInZhbHVlIjoiNVNYWWlpdjdwT2hpeUFTV24zcTBsOEMrUVNYRGpyVjNxUUxvMW1PanFhTU9uZEFPUng1Q2FxMGd1VWFiR0x5RExuT1ZyWFZKblMyWGNmbkliNW02anNzTHVGMmFwQUVDVHN1aFdhTlU0S3U1c3pqM2ZNQ0d0TVVrb1NBL3k1cG8iLCJtYWMiOiI0ODc1NTZiMDJlMjRmNDNlODU1MTEwMjA1ODMxOGYyOTU2MDk3MWNkZDY0MDExZDgyNTMwOTYxZDNkOGI1MTFkIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im142.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkFCQk1FWlpiRFM2NGFpZmg3NSticlE9PSIsInZhbHVlIjoiVzBCS3lmYXFodmx2QnR2dmkrN3RaQTFwMmoyenhmZTNUOFBHTjRzc25YT0Z1aUxVTjdHZGQ1cks5UHhOWUZ3bzVNTGdvTGxTWW1SZjRUSFR4SGdVTnhlUmdzYWdmY1hZa0NLVk9CREI5NW9oQ1RGb0JzK3F1YlpmMjVLUjMzYWoiLCJtYWMiOiI4YzQ5YTg2NWE3NzllM2M5YjcwODA2Mzg5MGQ0YTYyZGRiZjEwMWFkMjg0Y2ViMDJhZGMxZjBkMjU5OWE2Y2RmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImozaVk0THR6ZFVqNEQwaFBnOEVOV1E9PSIsInZhbHVlIjoiNVNYWWlpdjdwT2hpeUFTV24zcTBsOEMrUVNYRGpyVjNxUUxvMW1PanFhTU9uZEFPUng1Q2FxMGd1VWFiR0x5RExuT1ZyWFZKblMyWGNmbkliNW02anNzTHVGMmFwQUVDVHN1aFdhTlU0S3U1c3pqM2ZNQ0d0TVVrb1NBL3k1cG8iLCJtYWMiOiI0ODc1NTZiMDJlMjRmNDNlODU1MTEwMjA1ODMxOGYyOTU2MDk3MWNkZDY0MDExZDgyNTMwOTYxZDNkOGI1MTFkIiwidGFnIjoiIn0%3D

Source: global traffic	DNS traffic detected: DNS query: im20.net
Source: global traffic	DNS traffic detected: DNS query: tretwq.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: im142.mom
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://im20.net/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Windows Analysis Report
http://im20.net/