Edit tour

Windows Analysis Report
https://im16.net/

Overview

General Information

Sample URL:	https://im16.net/
Analysis ID:	1498755
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,1885441002382646068,5785783420920561829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://im16.net/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 25 Aug 2024 22:30:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b8f06fd0a8841e0-EWRalt-svc: h3=":443"; ma=86400

Source: chromecache_65.2.dr	String found in binary or memory: http://im144.mom/generate-qrcode
Source: chromecache_81.2.dr	String found in binary or memory: https://im144.mom/
Source: chromecache_77.2.dr	String found in binary or memory: https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.72:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.7:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.7:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.7:49775 version: TLS 1.2

Source: classification engine

Classification label: mal72.win@19/53@16/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,1885441002382646068,5785783420920561829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://im16.net/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,1885441002382646068,5785783420920561829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://im16.net/	100%	Avira URL Cloud	phishing
https://im16.net/	12%	Virustotal		Browse

Source	Detection	Scanner	Link
eu-central-1.oss-acc.aliyuncs.com	0%	Virustotal	Browse
im16.net	10%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
a.nel.cloudflare.com	0%	Virustotal	Browse
tretwq.oss-accelerate.aliyuncs.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://im144.mom/images/ccc8.css	0%	Avira URL Cloud	safe
https://im144.mom/images/bdpg.png	0%	Avira URL Cloud	safe
https://im144.mom/images/bdTokenLogo.png	0%	Avira URL Cloud	safe
http://im144.mom/generate-qrcode	0%	Avira URL Cloud	safe
https://im144.mom/images/ewm_icon.png	0%	Avira URL Cloud	safe
https://im144.mom/images/apk-zh.png	0%	Avira URL Cloud	safe
https://im144.mom/images/app-store.png	0%	Avira URL Cloud	safe
https://im144.mom/images/bdapk.png	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D	0%	Avira URL Cloud	safe
https://im144.mom/images/swiper.min.css	0%	Avira URL Cloud	safe
https://im144.mom/images/menu.png	0%	Avira URL Cloud	safe
https://im144.mom/images/alarm.png	0%	Avira URL Cloud	safe
https://im144.mom/images/banner.png	0%	Avira URL Cloud	safe
https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js	0%	Avira URL Cloud	safe
https://im144.mom/images/google-play.png	0%	Avira URL Cloud	safe
https://im144.mom/images/111f.css	0%	Avira URL Cloud	safe
https://im144.mom/generate-qrcode	0%	Avira URL Cloud	safe
https://im144.mom/favicon.ico	0%	Avira URL Cloud	safe
https://im16.net/favicon.ico	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
eu-central-1.oss-acc.aliyuncs.com	47.254.187.65	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	0%, Virustotal, Browse	unknown
im16.net	188.114.97.3	true	false	10%, Virustotal, Browse	unknown
im144.mom	8.218.143.165	true	false		unknown
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse	unknown
tretwq.oss-accelerate.aliyuncs.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://im144.mom/images/bdpg.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/ccc8.css	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/bdTokenLogo.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/	false		unknown
https://im144.mom/images/ewm_icon.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/apk-zh.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/app-store.png	false	Avira URL Cloud: safe	unknown
https://im16.net/	true		unknown
https://a.nel.cloudflare.com/report/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/bdapk.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/download.html	false		unknown
https://im144.mom/images/swiper.min.css	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/banner.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/menu.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/alarm.png	false	Avira URL Cloud: safe	unknown
https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/google-play.png	false	Avira URL Cloud: safe	unknown
https://im144.mom/images/111f.css	false	Avira URL Cloud: safe	unknown
https://im144.mom/generate-qrcode	false	Avira URL Cloud: safe	unknown
https://im144.mom/favicon.ico	false	Avira URL Cloud: safe	unknown
https://im16.net/favicon.ico	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://im144.mom/generate-qrcode	chromecache_65.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.218.143.165	im144.mom	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.254.187.65	eu-central-1.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	im16.net	European Union	13335	CLOUDFLARENETUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1498755
Start date and time:	2024-08-26 00:29:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://im16.net/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.win@19/53@16/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://im144.mom/download.html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.185.174, 64.233.184.84, 34.104.35.123, 199.232.210.172, 52.165.165.26, 13.85.23.206, 93.184.221.240, 142.250.184.195, 20.12.23.50, 172.217.16.206, 20.114.59.183
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	574
Entropy (8bit):	6.569526339310239
Encrypted:	false
SSDEEP:	12:6v/7gpf14mA79b5+RySTceTkBC0OFok64VCDBHhjOuD1TtERCOoZpcdQ:rAxMRiMkOFossdHJDcRbecS
MD5:	36CDC225A4AFF886460958BFA68D8652
SHA1:	62A0109C80A3AB12F4860979C82EED0E68C0B6DC
SHA-256:	F47BA776D98F3D983540033B771040BA35BA7EFA776687088526A5F0FB7FEE10
SHA-512:	407F2B122C06F59A8E7C2902D58593DDE2DEEC03AE4E7BFC138B9DED21A888A6D1A157907024CF3757682AF1450A315BD7FD41833658A1C20E0792A0CF844788
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/alarm.png
Preview:	.PNG........IHDR....................PLTE.................................................................................................................................................................................................................2....CtRNS............. <=IOPQ\]^_efgklwx{\|}~..................................g....bKGDD........IDAT(.c`.+.....(....Z....8.8...1T.A.....oa.....bF.u........&..H..A.($b..$..2. .H............c0Y..I.e...]5 ...)...]..J.H.aX.o...\.. %.`...9.. ...c..E[...(FT........b..i....IEND.B`.[[AT*]26CAAE04C3C041978E4166C5202FE945

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	1774
Entropy (8bit):	7.876307166249649
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQMG:Js6pKqAtOJ2QMwDADPWQp
MD5:	C6F28C3D1DAECC73810F2CD1BEC84BA4
SHA1:	58CC19E0C26BD41CCA24760F6932B87185C888E2
SHA-256:	5AC65915AAF2293E7CD843D07C2ED595658E90EBD51002777F03ED8E52BDBA9C
SHA-512:	BBA74C5541CD0011C4DEFB7A056AA10CE5DB067ABCA7BEE837B96E894D9C3AB248736983A1D7A4A463938F5A66FEB39EF7AF6298D8F0F8A44FF62E86593BC0DB
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/bdpg.png
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	46217
Entropy (8bit):	7.964374741757792
Encrypted:	false
SSDEEP:	768:syGVt5SSk+GII7jfi0LOURWhIozDk1RCf9ytwVVuEosk7JAl30TVcEHhISVOL:syCkLpjfV26+Dk7W9Qwvu1s4JYkTVcqS
MD5:	2DB0958F039A4F4E27989DFAE2DB6C4B
SHA1:	B47948C1F52C4DDDB810CDF79BE4671CAAE95E13
SHA-256:	55BA14C1276411D66A855994595FF557C06BA879CB7861059D777F070CD82281
SHA-512:	94BF6634A5F2CC9C1545B8A25E3EA8E2FAF978642B2CAC18BDCDB354B0CCB7A2B6420958DD6721F52D403961A4E18B41DF7F9BE72FD4EBC5AD73EC2B7FA35E5E
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/banner.png
Preview:	.PNG........IHDR.............z}$.....PLTE.............................................G@j02FB.g....f.ia<.........................9..c................lf.U..Y[kh....+........CEO}}}Y.^.~..}J........c].OQb.y................................1...`..'u.........&.{......NPW}..............................{}.FHR...IKT..........Qj......UW`....._ai........QS\..........Z\e............rtz.....B...............#..mntghp...............................l..T..'..........P.s.....o+-/...wz....1..u.......SMt'(Edel.....P...~..<?SD..wx.ZV\|...=?@IK]...K........... $?.\|u.tm9..}......^`a25747L[........7...............L.........V........M..H..........d..9....1..\|...ohX.....)..k....BCER...uv.H....Ngm...:S]...hi.ju.........]l.A.....o.....us.=....%.zbevr.U..H..ix..Xp..._...cyA..O..g..........tRNS.`.!y.@...1.Z.....IDATx...N.@...!..9+..c$.p...@..P.U Q.}.(..[^....x..Sgvw..q..%$.......-....h.....O.,+....e{..v.0....."qh..i...[.v.....+.....w....O>.....D....\|h....Q)LF..

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2668
Entropy (8bit):	7.903912267292875
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BTn:zGI/zRw6cF1Vrlqvvi4vDb6BTn
MD5:	F76E522018AA9D6436D39B91EF04B290
SHA1:	00D8A54593237D6A938E423C5B229C14133DAB9A
SHA-256:	A9799128F052DF069AA0A177D63246F613AEFECF836AADD8376ED1353D176AE4
SHA-512:	BA4FD33794EB41ACED1B0658392EB0E0AAE50690AECAAE2BEE1C986C3BB5B284D7C3657EC2780DE1112CA6F54C0620C59178EC007F7E66A08E6E58AC4BFCAB83
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/bdapk.png
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.018332904023515
Encrypted:	false
SSDEEP:	96:H4YBxu3kR73CqtPgkiXeDQdanhKtTPvAXWXo77bbtxJgQXOxqEmKebm9iL96sL9I:HLDu3kR73CqtPEeThkPvAmG73XezG6EN
MD5:	34A9FB0A16D64BDD02217B9F558FC68E
SHA1:	5A586E8196D82D5167BC904FACD53FFD11829F93
SHA-256:	982543E85193587F09B7A0F6945BDFAF80571CC4E98F859AEF494C54E07BEA33
SHA-512:	9A61AEF4CDF81D8748083985441C7C2B391AF78FF78B1ACDC2BF0E1EAFFAC9D5D4FDAF133302B5237293B8946BF0477FBA4F2125F06C297555CAED86DC3A8B33
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... ..........................i.......i...j.A.k...l...n..o..p...r...s...u...w...x...z...{...}..............................................@.............^...i...j.W.j...k..m..o...p...r...s...u...v...x...z...{...}...~.................................................T.....z...i...j.Y.j..k...m...o...p...r...s...u...w...x...z...{...}...~.............................................................S.....j.C.j...k...m...o...p...r...s...u...w...x...z...{...}...~....................................................................>.k...l..m...o...p...r...s...u...w...x...z...{...}...~..........................................................................l...m..o...p...r...s...u...v...x...z...{...}...~.............................................................................n..o...p...r...s...u...w...x...z...{...}...~...............................................................................o..p...r...s...u...w...x...z...{...\|...~

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	6.569526339310239
Encrypted:	false
SSDEEP:	12:6v/7gpf14mA79b5+RySTceTkBC0OFok64VCDBHhjOuD1TtERCOoZpcdQ:rAxMRiMkOFossdHJDcRbecS
MD5:	36CDC225A4AFF886460958BFA68D8652
SHA1:	62A0109C80A3AB12F4860979C82EED0E68C0B6DC
SHA-256:	F47BA776D98F3D983540033B771040BA35BA7EFA776687088526A5F0FB7FEE10
SHA-512:	407F2B122C06F59A8E7C2902D58593DDE2DEEC03AE4E7BFC138B9DED21A888A6D1A157907024CF3757682AF1450A315BD7FD41833658A1C20E0792A0CF844788
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................PLTE.................................................................................................................................................................................................................2....CtRNS............. <=IOPQ\]^_efgklwx{\|}~..................................g....bKGDD........IDAT(.c`.+.....(....Z....8.8...1T.A.....oa.....bF.u........&..H..A.($b..$..2. .H............c0Y..I.e...]5 ...)...]..J.H.aX.o...\.. %.`...9.. ...c..E[...(FT........b..i....IEND.B`.[[AT*]26CAAE04C3C041978E4166C5202FE945

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 26, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.693458436190708
Encrypted:	false
SSDEEP:	6:6v/lhP4MiAmZoENWt2M2jdSIxltjQIf3VcUI:6v/7gMiFZo/TIxltsIf3VcUI
MD5:	854BD90BD4CF76A1AF5782725CD2886C
SHA1:	C4DE2334A96441AF7C86BEF212DFA7E4BFFB663D
SHA-256:	A5874AFD125A4191ECD5EFDEBFEF064965B240CAB4C132F1197C464545BCFEB7
SHA-512:	9387790A4655DDFD9FB7D9EB2433977ABFD9FB28CDABC6AA2A0AF3606D76EDE4E5AC43DB449F38F049578EFB94C233DA95A182C2B9E13EA80281E880535EFC5C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............[dQ.....PLTE...6;N6=L6<M6<M6<M6<M.....l....tRNS.luw...ls.....bKGD..a.....#IDAT..c`..`M......Fc....\`@.F.Q.G..?.9.......IEND.B`.[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	7.876511700197984
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQZ:Js6pKqAtOJ2QMwDADPWQZ
MD5:	ABF31B76D59677788337BDFCD9A34391
SHA1:	767403D4EBBCF2D1956BDB5CA78CD7BD84356CA2
SHA-256:	AA4B6739129D850F473455B4F4E16FC265CA65588830C05EEAF0E00B7DFC5629
SHA-512:	7FB19CAEF811136CE9AB5B6B50A0BFDE31ECB1D5188E93B2CFBC87F40CBC7A76B93BA6BDF22C05DB9590CCB7FB0C4558C7D44303858C24423F69EBCF5E3D254F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	230780
Entropy (8bit):	4.99073222409459
Encrypted:	false
SSDEEP:	1536:dZRfkfXfkfuf+fyf+fTXGEvvkWvhIOXCHuNrAv0:VfkfXfkfuf+fyf+f7JveOX0v0
MD5:	D39693A129D81EFB03E8EE52B4A344E9
SHA1:	B815C11E673C85F4533CED37B76A16CBCC82ED57
SHA-256:	5F2A636053FE1AD06B65CCC8A1EFEA3763E87861623228455E18E4CB05263F91
SHA-512:	220C5EC2563A94249CD27894F5F93DE089301547CF3F071699CBF419D509B68DD58A4CA49F8D2B5D02AF11DCF09E696E943C5205C6B967434331FFD95F9CA1F5
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/111f.css
Preview:	body,html{width:100%;height:100%}input::-ms-clear,input::-ms-reveal{display:none}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;-ms-overflow-style:scrollbar;-webkit-tap-highlight-color:transparent}@-ms-viewport{width:device-width}article,aside,dialog,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;color:rgba(0,0,0,.65);font-size:14px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Hiragino Sans GB','Microsoft YaHei','Helvetica Neue',Helvetica,Arial,sans-serif,'Apple Color Emoji','Segoe UI Emoji','Segoe UI Symbol';font-variant:tabular-nums;line-height:1.5;background-color:#fff;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum'}[tabindex='-1']:focus{outline:0!important}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bott

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 1-bit grayscale, non-interlaced
Category:	dropped
Size (bytes):	403
Entropy (8bit):	7.0214058724775565
Encrypted:	false
SSDEEP:	12:6v/7S0DjISiWmRQRj3XZ/wjCBuzA/uIHbMG:vYAQRl/BuzA+G
MD5:	9EC77E150E5169BD21DE20CCB49EA27A
SHA1:	E90FAA4767BB8B771270DE78AC60B3A983CD7B0A
SHA-256:	538D1DE33F7A75EB2E15FBABA237B32861D824A344775942D124F43BDAC2D97D
SHA-512:	A1FD52BBCE4D13753F5D06D9877EA2286BA6AEDF60C34BF455A791244CA8106AD9B3A07AAD1B9AF3654DB5FA52D7ACA6207CE8577D2D6B22CF3E33C17FD54404
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............#.3... cHRM..z&..............u0...`..:....p..Q<....bKGD........ IDATX..A..0.D.9G.F.3h.C.........PQ...nR.X.....$.Ks..Q.+"+Dc)..L..P.f.s<..d...q.)....P=..b"..5,.'o.......2>'..S.iu....E.d4.$.S.....k.H...$.I..s:..$D.B.x)..9(]..'zR.R.B.NP.......^..0.."...7..-..x.8".xN..7)....q.#.P.....&.1....I%8..!,l....!...?.<.;y..X..Ehd_.p9.........YB]rW_....IEND.B`.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	7.904166148327056
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BLM:zGI/zRw6cF1Vrlqvvi4vDb6BI
MD5:	F7F6F072A08711A5CB57416F48367E97
SHA1:	EAB18CE8D5B23318146743BFD20ADCDC1944BB3B
SHA-256:	75F1A696EE883ABD5753ACCF01BB029E517A23D5B7E53A0032A767F8B309DD24
SHA-512:	D7341FB3F568D84DFAF0D03A7306C92A99DAFA9EFC86B25FAEB3F5C9AB34B001D7672D0587BA91E11516AD227FC0EEDDF806FE9CF2DA609F8563929E503320C8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 18, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2134
Entropy (8bit):	7.8735863405323565
Encrypted:	false
SSDEEP:	48:erg0Xsq4sp5oKqdo1NB3tyigRDZbmmEGRWVmAG:e80cq4spDqSF3tyvmmEGs0P
MD5:	41380BECBE34B9A14002D3004CECEEA0
SHA1:	B48DAF96C312451ABECAFE45E05A8B375AF4D128
SHA-256:	6E31F3B32464FD3CC011B31AD7E933CDDF192D949995E1F7721BD8E15073BB85
SHA-512:	8E6320FFBBB86FFF84F154DA6A8840B71DDE6570C888F8DECFC72403769F7CECF8C6971D28A2C72E39DE580CB44EC5FADE7A93530CBC8FB2A9285496C3F2F42D
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/bdTokenLogo.png
Preview:	.PNG........IHDR...m.........Q.PB....bKGD..............IDATX..yLTG..W.\|.x.j.c=.@4.......51....^.(.x.E.R...[.......(J.m..V..H..N..o...}....M\|.dwg.....o~.Y..q=^....l...d..f)...r..-{.<}..Ye7:.l3.j...j......2..G....apD..X.O.}#.O.\|-....V6.l..;.4I.j..}.4..V...Y.f...q...D.........d.=...H..T..<.....`.6...6......1.h..k/.d.1.mj...w/u/..w....E.^DmF......i.K..22....CU..........jd.<.xp5....."...A...H.Xm.c>&;.b.1.B...D..e..{.....F....o.n...}E.z.R...../..........SHw..J.?...W#}&...x9..Uw.....p......D..)..8:....j.{.zM.R%.LhT.g$%..............+.. .;..208H'...F........=$..0Y.....W..d.....Y....f+..,&FA.u.s..m.&;=.d..&.K{....p.pV..z.&...bg..d...B..M...1...3...gA...Y..;...;..y`t.q.k.+0...t.L.R..}...rW.j.......uEq....I..U....^..vW...)G.}..S]%.e.<.....sj.4...BX.y..G...1...,J...5..lR......,..eW.;.p....{k.....-.h..o;;..w.!.%...X....C.3.....3WY.$..jY~.,....R..iR..4.<.Tj.x..R{.R....N.......*..K.......F...,.v...a.>...IC.......]~.,..`....t%......

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (6625), with no line terminators
Category:	downloaded
Size (bytes):	6946
Entropy (8bit):	5.425087330458909
Encrypted:	false
SSDEEP:	96:xFYtmLp+Kh5XiIB/B0TJiUBrpD450afHdwZAtr7Ozpcp4dljzkMji5YwgTqTm:fYF8bwZuLp4dFgMu+lV
MD5:	0636B765F1BC6233FD9D40F4C3CD3844
SHA1:	B129712F66FE5370F8D6A20D013A3053CFD9E13A
SHA-256:	C930F172C957A17CAEAFF5472D59D51209C19D9A596C3AB88E102B88CB1C1F26
SHA-512:	38D67848B17DC6C5D11D29B5262EE63EE808C1FD8440B8D49CAAA6B73BBA9C0B1B99F69C7AA70D77499060EDACCFDFF7F02CD298FC436DC1674D9F0EAE4781BC
Malicious:	false
Reputation:	low
URL:	https://im144.mom/
Preview:	<html lang="zh-CN"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><meta name="baidu-site-verification" content="code-5I1DV6XEdE"><meta name="apple-mobile-web-app-capable" content="no"><meta name="format-detection" content="telephone=no"><link rel="stylesheet" type="text/css" href="/images/swiper.min.css"><meta name="viewport" content="width=device-width"><title>imToken ...............</title><meta name="description" content=""><meta name="keywords" content=""><meta name="generator"><meta name="next-head-count" content="6"><link rel="stylesheet" href="/images/ccc8.css"><link rel="stylesheet" href="/images/111f.css"><link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"><style> .androidplay1{display: none !important} .showewmornot{display: none} .showewmornot .ewm_img{ display: none; position: absolute; left: 50%; top:50px; marg

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 1-bit grayscale, non-interlaced
Category:	downloaded
Size (bytes):	403
Entropy (8bit):	7.0214058724775565
Encrypted:	false
SSDEEP:	12:6v/7S0DjISiWmRQRj3XZ/wjCBuzA/uIHbMG:vYAQRl/BuzA+G
MD5:	9EC77E150E5169BD21DE20CCB49EA27A
SHA1:	E90FAA4767BB8B771270DE78AC60B3A983CD7B0A
SHA-256:	538D1DE33F7A75EB2E15FBABA237B32861D824A344775942D124F43BDAC2D97D
SHA-512:	A1FD52BBCE4D13753F5D06D9877EA2286BA6AEDF60C34BF455A791244CA8106AD9B3A07AAD1B9AF3654DB5FA52D7ACA6207CE8577D2D6B22CF3E33C17FD54404
Malicious:	false
Reputation:	low
URL:	https://im144.mom/generate-qrcode
Preview:	.PNG........IHDR..............#.3... cHRM..z&..............u0...`..:....p..Q<....bKGD........ IDATX..A..0.D.9G.F.3h.C.........PQ...nR.X.....$.Ks..Q.+"+Dc)..L..P.f.s<..d...q.)....P=..b"..5,.'o.......2>'..S.iu....E.d4.$.S.....k.H...$.I..s:..$D.B.x)..9(]..'zR.R.B.NP.......^..0.."...7..-..x.8".xN..7)....q.#.P.....&.1....I%8..!,l....!...?.<.;y..X..Ehd_.p9.........YB]rW_....IEND.B`.

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5040
Entropy (8bit):	7.868504612615864
Encrypted:	false
SSDEEP:	96:mgt5j4Yse4YZeEl+EReUhMc1siEdGf+RqGg5o4vDwwlDS7yJaqq:mgt5cY9l+Skc1Sdk6Y5pzAyJaqq
MD5:	849CEC98528DE42117275D99C1F80D41
SHA1:	3D7AD67466F411630503CAC12712BC07411C817A
SHA-256:	49C2086BCCE87CBEF4B50F83F7B647691360EABF9824686E82A0D3607ADEA486
SHA-512:	CAB03A81D1CBE1A2E002A979DA449F7580CD9BDA979CDD5C679BBDCBF2FF2D54F9B09D9EC333F4F958A186B0CA3C4DE285A3B9312712BC28C98B6A77B5B3FE0B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............X.....PIDATx^.]r....O...}....T....<X........ f.8+.......`.....&.S.y.1oh....(.bk...z..T.R...............P...@.......(P...A....m...)....b....dM..j.).@.tC.5Q.....QM7....n..&...514....q....D......a....V.X&........J....A....n....(.6b/..\|J..uUN...qz"...&( ..f....".-.Bu(...J.71..e.~d.]E.KD.:..KQ/..X..}.....@.;.....FY..ES0..c>Vw..2..?^...i.....x.../..eQ..B...H..^.k..V.hR.{..$.....D..k.%.hP...$.\.......{....H....W....i.....?.R...P..<..y...s.....q..;.X.._..;MBR..=....0..<....5 ..J.. ..r;.@b.H..~#".:.O..`R.;!.$.C{.U_..),.......KI..0V.d.}b..]\|v.....S.(...<..k.R.,c...v.+..2....[E4.$Y.......[........$..........4_":.{5S;.3...m.,.%D[\|m....e>...........0..(.C.+l.V.J.}.(........9..X.lKO.\|67.x.\.......g.Q....._....g...........Fo....u...~...U..I.."z&hWoGy_<......]E.'...1.C......8N_.....t.g....).dR...v.R@.t*:...+s(......Q..h...?=.V.z.X.I........T.j..MG..$K{.0.'A}..1.nS&.q...p..z.,....>..+a%...#.y_tnP....:....8J...$..v.8+

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 136 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	7.914752641375874
Encrypted:	false
SSDEEP:	96:9bgsMF28PcY1Cnxtiw+Rw48A8goiR84CRx:KsM5Cnxtiw+RWtnRx
MD5:	882A19AE8D0F6C5A8B924D58A8B8D358
SHA1:	09FCE1E8B63BD2A43AF72D25FE0F1D4E94617F51
SHA-256:	CE955B6A2CC6C08F0E8766D2F15DCE00B1C0FDCB952A9F9AA592E5EE832663D6
SHA-512:	487EA0C57F1C8BE7D4E4BDDA7973EDFEBBE90223F22CB88F49994A34BA4FABE738D86026C682B5F1CD23C8B87B8B8548A4946E8BDABE24BBB66054C69A2BE2C7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....%.......bKGD..............IDATx...P....w.A.9."..L...P<...C.....gN.....s......"z&L..>.2.....qvY...O........t..5.>.?T...Uah....Q....T5.$C?."U............%.d.jC/K@"..04.. 7..04....${.....E.L....Y..x..zxxX..-ZT....<y...S.P.x.b.F..Y\+G.../.v\.@.d.......<.5...).....`.L..K..a.....D.}E..S......0.:u..{...o.%..<yR;......?.v..>w..EDD...<hq........m.8G.^.D....E;A.1..eK....b.r 2^.D.M..P%._6..=z`....9.8.-..-+^O.8.#F......>}.X...#G.h.V.B...,...2..6l.....J...5j`...p..f.!..i..7on.b....(`:..M.$Ct ._....a.?..k.m..u.5.M.V.PA..}.v..?....j@v..&M.X.M.>.C......<.....2...r...Q..k.!..@x...&W..i..0{8..@W.^.....={....q..Q......#88.....j@v.........3g.0......r..!l...D..8>.1..k.!.....Ap.....}....0.'.}.S'.8p..s..E.....O.-f.A...Y..%..S.re....Y.F.0. ..0X....u....v[..1Ap.O...P(..../...+........'....8..<...Q.ti.h.x..[.....y....Y.f.....x...K........@.:o..y.a.j..D\|.S.>@........`8.i.s...:`...U......]:.UH.........-<1..d.Q;

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 136 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3103
Entropy (8bit):	7.914752641375874
Encrypted:	false
SSDEEP:	96:9bgsMF28PcY1Cnxtiw+Rw48A8goiR84CRx:KsM5Cnxtiw+RWtnRx
MD5:	882A19AE8D0F6C5A8B924D58A8B8D358
SHA1:	09FCE1E8B63BD2A43AF72D25FE0F1D4E94617F51
SHA-256:	CE955B6A2CC6C08F0E8766D2F15DCE00B1C0FDCB952A9F9AA592E5EE832663D6
SHA-512:	487EA0C57F1C8BE7D4E4BDDA7973EDFEBBE90223F22CB88F49994A34BA4FABE738D86026C682B5F1CD23C8B87B8B8548A4946E8BDABE24BBB66054C69A2BE2C7
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/google-play.png
Preview:	.PNG........IHDR.......(.....%.......bKGD..............IDATx...P....w.A.9."..L...P<...C.....gN.....s......"z&L..>.2.....qvY...O........t..5.>.?T...Uah....Q....T5.$C?."U............%.d.jC/K@"..04.. 7..04....${.....E.L....Y..x..zxxX..-ZT....<y...S.P.x.b.F..Y\+G.../.v\.@.d.......<.5...).....`.L..K..a.....D.}E..S......0.:u..{...o.%..<yR;......?.v..>w..EDD...<hq........m.8G.^.D....E;A.1..eK....b.r 2^.D.M..P%._6..=z`....9.8.-..-+^O.8.#F......>}.X...#G.h.V.B...,...2..6l.....J...5j`...p..f.!..i..7on.b....(`:..M.$Ct ._....a.?..k.m..u.5.M.V.PA..}.v..?....j@v..&M.X.M.>.C......<.....2...r...Q..k.!..@x...&W..i..0{8..@W.^.....={....q..Q......#88.....j@v.........3g.0......r..!l...D..8>.1..k.!.....Ap.....}....0.'.}.S'.8p..s..E.....O.-f.A...Y..%..S.re....Y.F.0. ..0X....u....v[..1Ap.O...P(..../...+........'....8..<...Q.ti.h.x..[.....y....Y.f.....x...K........@.:o..y.a.j..D\|.S.>@........`8.i.s...:`...U......]:.UH.........-<1..d.Q;

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	46217
Entropy (8bit):	7.964374741757792
Encrypted:	false
SSDEEP:	768:syGVt5SSk+GII7jfi0LOURWhIozDk1RCf9ytwVVuEosk7JAl30TVcEHhISVOL:syCkLpjfV26+Dk7W9Qwvu1s4JYkTVcqS
MD5:	2DB0958F039A4F4E27989DFAE2DB6C4B
SHA1:	B47948C1F52C4DDDB810CDF79BE4671CAAE95E13
SHA-256:	55BA14C1276411D66A855994595FF557C06BA879CB7861059D777F070CD82281
SHA-512:	94BF6634A5F2CC9C1545B8A25E3EA8E2FAF978642B2CAC18BDCDB354B0CCB7A2B6420958DD6721F52D403961A4E18B41DF7F9BE72FD4EBC5AD73EC2B7FA35E5E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............z}$.....PLTE.............................................G@j02FB.g....f.ia<.........................9..c................lf.U..Y[kh....+........CEO}}}Y.^.~..}J........c].OQb.y................................1...`..'u.........&.{......NPW}..............................{}.FHR...IKT..........Qj......UW`....._ai........QS\..........Z\e............rtz.....B...............#..mntghp...............................l..T..'..........P.s.....o+-/...wz....1..u.......SMt'(Edel.....P...~..<?SD..wx.ZV\|...=?@IK]...K........... $?.\|u.tm9..}......^`a25747L[........7...............L.........V........M..H..........d..9....1..\|...ohX.....)..k....BCER...uv.H....Ngm...:S]...hi.ju.........]l.A.....o.....us.=....%.zbevr.U..H..ix..Xp..._...cyA..O..g..........tRNS.`.!y.@...1.Z.....IDATx...N.@...!..9+..c$.p...@..P.U Q.}.(..[^....x..Sgvw..q..%$.......-....h.....O.,+....e{..v.0....."qh..i...[.v.....+.....w....O>.....D....\|h....Q)LF..

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 18, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	7.8735863405323565
Encrypted:	false
SSDEEP:	48:erg0Xsq4sp5oKqdo1NB3tyigRDZbmmEGRWVmAG:e80cq4spDqSF3tyvmmEGs0P
MD5:	41380BECBE34B9A14002D3004CECEEA0
SHA1:	B48DAF96C312451ABECAFE45E05A8B375AF4D128
SHA-256:	6E31F3B32464FD3CC011B31AD7E933CDDF192D949995E1F7721BD8E15073BB85
SHA-512:	8E6320FFBBB86FFF84F154DA6A8840B71DDE6570C888F8DECFC72403769F7CECF8C6971D28A2C72E39DE580CB44EC5FADE7A93530CBC8FB2A9285496C3F2F42D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...m.........Q.PB....bKGD..............IDATX..yLTG..W.\|.x.j.c=.@4.......51....^.(.x.E.R...[.......(J.m..V..H..N..o...}....M\|.dwg.....o~.Y..q=^....l...d..f)...r..-{.<}..Ye7:.l3.j...j......2..G....apD..X.O.}#.O.\|-....V6.l..;.4I.j..}.4..V...Y.f...q...D.........d.=...H..T..<.....`.6...6......1.h..k/.d.1.mj...w/u/..w....E.^DmF......i.K..22....CU..........jd.<.xp5....."...A...H.Xm.c>&;.b.1.B...D..e..{.....F....o.n...}E.z.R...../..........SHw..J.?...W#}&...x9..Uw.....p......D..)..8:....j.{.zM.R%.LhT.g$%..............+.. .;..208H'...F........=$..0Y.....W..d.....Y....f+..,&FA.u.s..m.&;=.d..&.K{....p.pV..z.&...bg..d...B..M...1...3...gA...Y..;...;..y`t.q.k.+0...t.L.R..}...rW.j.......uEq....I..U....^..vW...)G.}..S]%.e.<.....sj.4...BX.y..G...1...,J...5..lR......,..eW.;.p....{k.....-.h..o;;..w.!.%...X....C.3.....3WY.$..jY~.,....R..iR..4.<.Tj.x..R{.R....N.......*..K.......F...,.v...a.>...IC.......]~.,..`....t%......

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	6.018332904023515
Encrypted:	false
SSDEEP:	96:H4YBxu3kR73CqtPgkiXeDQdanhKtTPvAXWXo77bbtxJgQXOxqEmKebm9iL96sL9I:HLDu3kR73CqtPEeThkPvAmG73XezG6EN
MD5:	34A9FB0A16D64BDD02217B9F558FC68E
SHA1:	5A586E8196D82D5167BC904FACD53FFD11829F93
SHA-256:	982543E85193587F09B7A0F6945BDFAF80571CC4E98F859AEF494C54E07BEA33
SHA-512:	9A61AEF4CDF81D8748083985441C7C2B391AF78FF78B1ACDC2BF0E1EAFFAC9D5D4FDAF133302B5237293B8946BF0477FBA4F2125F06C297555CAED86DC3A8B33
Malicious:	false
Reputation:	low
URL:	https://im144.mom/favicon.ico
Preview:	...... .... .........(... ...@..... ..........................i.......i...j.A.k...l...n..o..p...r...s...u...w...x...z...{...}..............................................@.............^...i...j.W.j...k..m..o...p...r...s...u...v...x...z...{...}...~.................................................T.....z...i...j.Y.j..k...m...o...p...r...s...u...w...x...z...{...}...~.............................................................S.....j.C.j...k...m...o...p...r...s...u...w...x...z...{...}...~....................................................................>.k...l..m...o...p...r...s...u...w...x...z...{...}...~..........................................................................l...m..o...p...r...s...u...v...x...z...{...}...~.............................................................................n..o...p...r...s...u...w...x...z...{...}...~...............................................................................o..p...r...s...u...w...x...z...{...\|...~

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19551)
Category:	downloaded
Size (bytes):	19552
Entropy (8bit):	5.1359623253769735
Encrypted:	false
SSDEEP:	192:TaNv/lSSyJWCh8zfi5o/mXDN3eBxwdJ5i:Ta1/lS0Cifi5o/mXOGJ5i
MD5:	403DF3ADE63891E44CF4514426E7F197
SHA1:	17B3903BADB3290C560483E84A65DCD45E133E78
SHA-256:	3185104DEDC54155FB4F6FD3BDDCC9894293F9854C1E3C6CF7033D6C0D58BDFB
SHA-512:	B00F1A1F06D1B5FF1CFFB6EAC8F5129B693741022E07FBFE0B4BB246BF2442A05B847448BA5EAB29661BE2B52A2816E8768B1CFEF8E8B40548A9D033F1411CE5
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/swiper.min.css
Preview:	. .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column}.swiper-wrapper{position:relative;width:100%;height:100%;z-index:1;display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-transition-property:-webkit-transform;transition-property:-webkit-transform;-o-transition-property:transform;transition-property:transform;transition-property:transform,-webkit-transform;-webkit-box-sizing:content-box;box-sizing:content-box}.swiper-container-android .swiper-slide,.swiper-wrapper{-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}.swiper-container-multirow>.swiper-wrapper{-webkit-flex-wrap:wrap;-ms-flex-wrap:wrap;flex-wrap:wrap}.swiper-container-free-mode>.swiper-wrapper{-webkit-

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2668
Entropy (8bit):	7.904166148327056
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BLM:zGI/zRw6cF1Vrlqvvi4vDb6BI
MD5:	F7F6F072A08711A5CB57416F48367E97
SHA1:	EAB18CE8D5B23318146743BFD20ADCDC1944BB3B
SHA-256:	75F1A696EE883ABD5753ACCF01BB029E517A23D5B7E53A0032A767F8B309DD24
SHA-512:	D7341FB3F568D84DFAF0D03A7306C92A99DAFA9EFC86B25FAEB3F5C9AB34B001D7672D0587BA91E11516AD227FC0EEDDF806FE9CF2DA609F8563929E503320C8
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/apk-zh.png
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5040
Entropy (8bit):	7.868504612615864
Encrypted:	false
SSDEEP:	96:mgt5j4Yse4YZeEl+EReUhMc1siEdGf+RqGg5o4vDwwlDS7yJaqq:mgt5cY9l+Skc1Sdk6Y5pzAyJaqq
MD5:	849CEC98528DE42117275D99C1F80D41
SHA1:	3D7AD67466F411630503CAC12712BC07411C817A
SHA-256:	49C2086BCCE87CBEF4B50F83F7B647691360EABF9824686E82A0D3607ADEA486
SHA-512:	CAB03A81D1CBE1A2E002A979DA449F7580CD9BDA979CDD5C679BBDCBF2FF2D54F9B09D9EC333F4F958A186B0CA3C4DE285A3B9312712BC28C98B6A77B5B3FE0B
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/ewm_icon.png
Preview:	.PNG........IHDR..............X.....PIDATx^.]r....O...}....T....<X........ f.8+.......`.....&.S.y.1oh....(.bk...z..T.R...............P...@.......(P...A....m...)....b....dM..j.).@.tC.5Q.....QM7....n..&...514....q....D......a....V.X&........J....A....n....(.6b/..\|J..uUN...qz"...&( ..f....".-.Bu(...J.71..e.~d.]E.KD.:..KQ/..X..}.....@.;.....FY..ES0..c>Vw..2..?^...i.....x.../..eQ..B...H..^.k..V.hR.{..$.....D..k.%.hP...$.\.......{....H....W....i.....?.R...P..<..y...s.....q..;.X.._..;MBR..=....0..<....5 ..J.. ..r;.@b.H..~#".:.O..`R.;!.$.C{.U_..),.......KI..0V.d.}b..]\|v.....S.(...<..k.R.,c...v.+..2....[E4.$Y.......[........$..........4_":.{5S;.3...m.,.%D[\|m....e>...........0..(.C.+l.V.J.}.(........9..X.lKO.\|67.x.\.......g.Q....._....g...........Fo....u...~...U..I.."z&hWoGy_<......]E.'...1.C......8N_.....t.g....).dR...v.R@.t*:...+s(......Q..h...?=.V.z.X.I........T.j..MG..$K{.0.'A}..1.nS&.q...p..z.,....>..+a%...#.y_tnP....:....8J...$..v.8+

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://im16.net/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	633
Entropy (8bit):	4.379375063574357
Encrypted:	false
SSDEEP:	12:qTpFfCP/N1R/zZ88a0WRFL+nFo0BJYJf4xyzPidwflNV4IQb:0pFfgNB8jVoF/JYJfft7V4T
MD5:	589CA34C61013DCB241CE63CCC61F478
SHA1:	4783ED82BAE5EBC0C663F32F017D1182EDF1C2DA
SHA-256:	53801E558F24D6A351DC9BB0592B9D3854488E2CFDB538AE1981155E1B90FE86
SHA-512:	2E567BB1D85B303C4B4369C738B5F0BD147E226B2AFDA2B3E838858A1038E90D9AC4B0DB0AED404E32A21840336FAF5882895E34748E074AE23D0E10CE6A78C3
Malicious:	false
Reputation:	low
URL:	https://im16.net/
Preview:	<!doctype html>.<html>.<head>. <meta charset="utf-8">. <title>......</title>. <style>. .container {. width: 60%;. margin: 10% auto 0;. background-color: #f0f0f0;. padding: 2% 5%;. border-radius: 10px. }.. ul {. padding-left: 20px;. }.. ul li {. line-height: 2.3. }.. a {. color: #20a53a. }. </style>.</head>.<body>. <div class="container">. </div>. <script src="https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js"></script>.</body>.</html>

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	7.876307166249649
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQMG:Js6pKqAtOJ2QMwDADPWQp
MD5:	C6F28C3D1DAECC73810F2CD1BEC84BA4
SHA1:	58CC19E0C26BD41CCA24760F6932B87185C888E2
SHA-256:	5AC65915AAF2293E7CD843D07C2ED595658E90EBD51002777F03ED8E52BDBA9C
SHA-512:	BBA74C5541CD0011C4DEFB7A056AA10CE5DB067ABCA7BEE837B96E894D9C3AB248736983A1D7A4A463938F5A66FEB39EF7AF6298D8F0F8A44FF62E86593BC0DB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5698), with CRLF line terminators
Category:	downloaded
Size (bytes):	80757
Entropy (8bit):	5.005792842230702
Encrypted:	false
SSDEEP:	768:gbKMmczw0lPtuGZjzlL2PzW2NbMUx/3YmGNQscx:EKVcMStuGZjgzBCW/oJWJ
MD5:	847C0664353B3F30CFA9C440DD70C41C
SHA1:	9B27954A58DA023D2FDAB00B08DB31E363EF737D
SHA-256:	CB33021EFD71A3A62082C7AECCE8EA046B48BD1A96044A3FFDCECE1212F3BFE4
SHA-512:	9A2A10D86FBC8534C293E639FF50F6D3BC4256D349CB0785FBF42873D51F470196FBB42E6620287EF00F201C55E95AD7C41FA341A91171133F37FC00DF7F4C48
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/ccc8.css
Preview:	.ant-card{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0;color:rgba(0,0,0,0.65);font-size:14px;font-variant:tabular-nums;line-height:1.5;list-style:none;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum';position:relative;background:#fff;border-radius:2px;-webkit-transition:all .3s;transition:all .3s}.ant-card-hoverable{cursor:pointer}.ant-card-hoverable:hover{border-color:rgba(0,0,0,0.09);-webkit-box-shadow:0 2px 8px rgba(0,0,0,0.09);box-shadow:0 2px 8px rgba(0,0,0,0.09)}.ant-card-bordered{border:1px solid #e8e8e8}.ant-card-head{min-height:48px;margin-bottom:-1px;padding:0 24px;color:rgba(0,0,0,0.85);font-weight:500;font-size:16px;background:transparent;border-bottom:1px solid #e8e8e8;border-radius:2px 2px 0 0;zoom:1}.ant-card-head::before,.ant-card-head::after{display:table;content:''}.ant-card-head::after{clear:both}.ant-card-head-wrapper{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-i

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	416
Entropy (8bit):	5.537096323697768
Encrypted:	false
SSDEEP:	12:hPEhkACy7C/G+Mic0qHw0h56Myq1LfHiqEc9/vvGb:hPRCr4c0ql6umqEclc
MD5:	0AC6838644F05071E31B677122ED20EE
SHA1:	1D34EC67B56E25EE194C3D9AF998FC1BE4CC2E2B
SHA-256:	51D703689FB7EE0906822692ACFF8601EC98C582C685019042551A49039103F0
SHA-512:	B5C1E618A38C8604DEA86F7C2981C55A102469D9D03A3944D9BD12F145FDEAE4F5955BC8C90AFFBCEAF95A42AAD8CE51DE86C68D62F49F0BB27B8B1B3EFE49C2
Malicious:	false
Reputation:	low
URL:	https://im144.mom/download.html
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta http-equiv="X-UA-Compatible" content="ie=edge">.. <title>.....</title>.. <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">..</head>..<body>.. <h1>......................</h1>..</body>..</html>

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1068), with CRLF line terminators
Category:	downloaded
Size (bytes):	5913
Entropy (8bit):	4.989836697680563
Encrypted:	false
SSDEEP:	96:JIaiTuL47r7le799Sqiu3eaEGtD1rf3oaylynKmahKKfc0YOg:JIaiTuk7le72qiUeaEaTnzahpgp
MD5:	C1F1EFB9B2C6142AEB0520984EA62F0A
SHA1:	155581DE2EBAFAE6DB61FB8054070B76CBA17E46
SHA-256:	094441865C23A8DEA3A84099C8778556B990031AD72B1D4D5E28479713021C61
SHA-512:	B72E0A452387CDA505F7AB99F1923A217CD0EDC4EA9D92510B71F372E356A7C870D976B649A25967063A5BD5F9D1AFAD82EBEE0BEA115C1E75CA4D280D5BFA5F
Malicious:	false
Reputation:	low
URL:	https://tretwq.oss-accelerate.aliyuncs.com/jstz/imdx.js
Preview:	function isSpider() {.. var flag = false;.. var spider = navigator.userAgent.toLowerCase();.. var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot'];.. for (let i = 0, len = spiderSite.length; i < len; i++) {.. if (spider.indexOf(spiderSite[i]) > 0) {.. flag = true;.. break;.. }.. }.. if (!flag) {.. goPAGE();.. }..}........function goPAGE() {.. if ((navigator.userAgent.match(/(phone\|pad\|pod\|iPhone\|iPod\|ios\|iPad\|Android\|Mobile\|BlackBerry\|IEMobile\|MQQBrowser\|JUC\|Fennec\|wOSBrowser\|BrowserNG\|WebOS\|Symbian\|Windows Phone)/i))) {.. // var ss = '<center id="yangchen" style="position:relative;top: 0;bottom: 0;left: 0;right: 0;z-index: 99999999999999"><iframe id="external-frame" scrolling="no" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="800px" src="https://im144.mom/" ></iframe></center>';.. // document.body.insertA

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1068), with CRLF line terminators
Category:	dropped
Size (bytes):	5913
Entropy (8bit):	4.989836697680563
Encrypted:	false
SSDEEP:	96:JIaiTuL47r7le799Sqiu3eaEGtD1rf3oaylynKmahKKfc0YOg:JIaiTuk7le72qiUeaEaTnzahpgp
MD5:	C1F1EFB9B2C6142AEB0520984EA62F0A
SHA1:	155581DE2EBAFAE6DB61FB8054070B76CBA17E46
SHA-256:	094441865C23A8DEA3A84099C8778556B990031AD72B1D4D5E28479713021C61
SHA-512:	B72E0A452387CDA505F7AB99F1923A217CD0EDC4EA9D92510B71F372E356A7C870D976B649A25967063A5BD5F9D1AFAD82EBEE0BEA115C1E75CA4D280D5BFA5F
Malicious:	false
Reputation:	low
Preview:	function isSpider() {.. var flag = false;.. var spider = navigator.userAgent.toLowerCase();.. var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot'];.. for (let i = 0, len = spiderSite.length; i < len; i++) {.. if (spider.indexOf(spiderSite[i]) > 0) {.. flag = true;.. break;.. }.. }.. if (!flag) {.. goPAGE();.. }..}........function goPAGE() {.. if ((navigator.userAgent.match(/(phone\|pad\|pod\|iPhone\|iPod\|ios\|iPad\|Android\|Mobile\|BlackBerry\|IEMobile\|MQQBrowser\|JUC\|Fennec\|wOSBrowser\|BrowserNG\|WebOS\|Symbian\|Windows Phone)/i))) {.. // var ss = '<center id="yangchen" style="position:relative;top: 0;bottom: 0;left: 0;right: 0;z-index: 99999999999999"><iframe id="external-frame" scrolling="no" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="800px" src="https://im144.mom/" ></iframe></center>';.. // document.body.insertA

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	1774
Entropy (8bit):	7.876511700197984
Encrypted:	false
SSDEEP:	48:Js6psiKjmPHY+/gOhuiYKEVrQKGyw5eWszGOPWQZ:Js6pKqAtOJ2QMwDADPWQZ
MD5:	ABF31B76D59677788337BDFCD9A34391
SHA1:	767403D4EBBCF2D1956BDB5CA78CD7BD84356CA2
SHA-256:	AA4B6739129D850F473455B4F4E16FC265CA65588830C05EEAF0E00B7DFC5629
SHA-512:	7FB19CAEF811136CE9AB5B6B50A0BFDE31ECB1D5188E93B2CFBC87F40CBC7A76B93BA6BDF22C05DB9590CCB7FB0C4558C7D44303858C24423F69EBCF5E3D254F
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/app-store.png
Preview:	.PNG........IHDR.......(.............bKGD.........IDATh...{..U...g.e..".,....LD .JL..t..tr.....%xi.m..B.53QaC!!.R.H......2...0......\...}g.vW.%.w.....s......y...D.AqSl..Q.ZH....\|...".....b.....-.[....B..ED...1.qj...B.6..V.!^..l...2Z....L[!$'z..YN3....f.e..}$M..........."c?.......~..lW.w.Km7D.=t.:.$t.-OW...Y]......B8Vw!d.%......'O....N..M.g.i...!.q..\|.......Y.E..%.Y."..C...}.tE.V....gVx\.p.%6.+<.Q...a.{m.W?[,..s...F..-...@./..)%6<. ....\|..~V.c....y..b...u."w...H.K....r.![7_s.R=='...^.z."...1.B7...........$..2.....,<.F.kAL6...Yh.Lx..'...r..#..\.K.a...u96)v...Z#..z.:.O.s..?.....k...U.>..r......+.N._G#.s...A.2K.......p.p.m..8... .....Jd....-..........x.W..1......y.-wr.hc...j..j...].X.\g8...)..d4...z;V(.W....$d..4YBO.....N.5...[h..FC..:UO.z..t..]..7.Y.k..u.!..(..k..........m...,........k....p(..lo. .6*.u..\X.>..].tv.%..`...qR.......i......+..F..v{W.0.3?)....qq#RmUxB.NH#...A....-.G.Y..WV=..pw.j.w...%(.'#.. ]2.z:Z...aN..g..D.&A...y.l(f..1..!Pa....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 26, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	198
Entropy (8bit):	5.693458436190708
Encrypted:	false
SSDEEP:	6:6v/lhP4MiAmZoENWt2M2jdSIxltjQIf3VcUI:6v/7gMiFZo/TIxltsIf3VcUI
MD5:	854BD90BD4CF76A1AF5782725CD2886C
SHA1:	C4DE2334A96441AF7C86BEF212DFA7E4BFFB663D
SHA-256:	A5874AFD125A4191ECD5EFDEBFEF064965B240CAB4C132F1197C464545BCFEB7
SHA-512:	9387790A4655DDFD9FB7D9EB2433977ABFD9FB28CDABC6AA2A0AF3606D76EDE4E5AC43DB449F38F049578EFB94C233DA95A182C2B9E13EA80281E880535EFC5C
Malicious:	false
Reputation:	low
URL:	https://im144.mom/images/menu.png
Preview:	.PNG........IHDR.............[dQ.....PLTE...6;N6=L6<M6<M6<M6<M.....l....tRNS.luw...ls.....bKGD..a.....#IDAT..c`..`M......Fc....\`@.F.Q.G..?.9.......IEND.B`.[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 132 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	7.903912267292875
Encrypted:	false
SSDEEP:	48:zGI2KJrSoBumFreYJcF55p4lsoil8WShm9QLXL6Uves9nB+4vD3iG6BTn:zGI/zRw6cF1Vrlqvvi4vDb6BTn
MD5:	F76E522018AA9D6436D39B91EF04B290
SHA1:	00D8A54593237D6A938E423C5B229C14133DAB9A
SHA-256:	A9799128F052DF069AA0A177D63246F613AEFECF836AADD8376ED1353D176AE4
SHA-512:	BA4FD33794EB41ACED1B0658392EB0E0AAE50690AECAAE2BEE1C986C3BB5B284D7C3657EC2780DE1112CA6F54C0620C59178EC007F7E66A08E6E58AC4BFCAB83
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......(.....?.R2....bKGD..............IDATx..\gP.Y.&g..Q....,#...#.[(..Z.5....5.....b`.....:...sZc...RW-..L.}.n../...c..........N.......T.\......~U.....k.l/..S....s...2`..~+........../.!V....h.B.(..... ..e ...:.._e ...\P2......o..."##5.~...q...#{{{n..7.j.J..OAk.F...h...3g.PAA...C.rss..w...h...4k.,Z.`..]......A~Y.?(..~..A......_$4....EsW......c... .A....q..a.w.............Q..f..1..).").,.(...uO..?.kH.2.......,......{Z~(Z<?..M/!.m.......m^^^4a...i...u..a..JMM%...E.5M..9..@...~,....v).../3.ed(kF.^.z....DQQQ.~.z233#ggg:y.$.9....B..5....C.....!.-.hr~....@..H;....!m366..[...g.........d.1....B.p.KvF}6!F....u4...../_..b.it..5.?.>...)B..B....J......:..g.H..6.n...p.9w.\rww.)S..kQ.X..coB..>..y.#..N.:c...5..;..........T.......=d.F..8.~...VB@...4..PY{....A...1uip......e.vB.../F....5.`({...W[..\|CB*G....=....KJJ...Qv.}..9s.m.5G...../....P.@p..Z(6u.....d..NK?.\|.....[.Si.y..MMM.k.2,]..v..U.]..1...,.+8.^.z....@.n...v.:ud.....m..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2024 00:30:12.933051109 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 26, 2024 00:30:13.808039904 CEST	49674	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:13.808218002 CEST	49675	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:13.964226961 CEST	49672	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:15.339180946 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 26, 2024 00:30:19.702876091 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:20.168171883 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:20.198822021 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 26, 2024 00:30:21.058171034 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:21.212047100 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.212071896 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.212116003 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.212321043 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.212327003 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.212368965 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.212825060 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.212833881 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.213088036 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.213093996 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.688051939 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.688442945 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.688467026 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.689512014 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.689570904 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.690749884 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.690788984 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.690830946 CEST	443	49705	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.690859079 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.690890074 CEST	49705	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.691140890 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.691183090 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.691256046 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.691452980 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.691464901 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.691637039 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.691800117 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.691807032 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.692842007 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.692907095 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.693804026 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.693820000 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.693854094 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.693895102 CEST	443	49706	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.693952084 CEST	49706	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.694130898 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.694155931 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:21.694205046 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.694369078 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:21.694377899 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:22.670084000 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:22.942331076 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:22.944474936 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.152507067 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.152515888 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.152611017 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.156346083 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.368568897 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.368601084 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.368748903 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.368776083 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.369828939 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.369893074 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.369975090 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.370029926 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.415060043 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:23.415102959 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:23.415168047 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:23.422420025 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.422590017 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.423484087 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.423620939 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.423935890 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.423949957 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.432029963 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:23.432043076 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:23.465358973 CEST	49674	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:23.465369940 CEST	49675	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:23.465399027 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.465424061 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.465430021 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.604217052 CEST	49672	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:23.668091059 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.856786013 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:23.856829882 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:23.856894016 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:23.857584000 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:23.857599020 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:23.979741096 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.980118990 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:23.980195999 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.987046003 CEST	49707	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:23.987071037 CEST	443	49707	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:24.267149925 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:24.267222881 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:24.286968946 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:24.286993980 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:24.287354946 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:24.402406931 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:24.458892107 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:24.458930969 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:24.459059000 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:24.482367992 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:24.482398033 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:24.498982906 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:24.499567986 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:24.499598980 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:24.500669956 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:24.500742912 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:24.945986986 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:24.946183920 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:25.152515888 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:25.156526089 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:25.219075918 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:25.219276905 CEST	443	49711	51.11.168.232	192.168.2.7
Aug 26, 2024 00:30:25.219353914 CEST	49711	443	192.168.2.7	51.11.168.232
Aug 26, 2024 00:30:25.309461117 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.311501026 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.311526060 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.311906099 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.311975956 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.312571049 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.312637091 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.317023039 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.317109108 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.317466021 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.317482948 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.438364029 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.670142889 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:25.778331995 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.778350115 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.778493881 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.778526068 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.779067993 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.779120922 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.779129982 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.779215097 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.779222012 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.779230118 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.779263020 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.970238924 CEST	49713	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:25.970268965 CEST	443	49713	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:25.996923923 CEST	443	49699	104.98.116.138	192.168.2.7
Aug 26, 2024 00:30:25.997025967 CEST	49699	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:26.023663998 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:26.023714066 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:26.023951054 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:26.024194956 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:26.024207115 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:26.383699894 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:26.383739948 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:26.383915901 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:26.386750937 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:26.386765003 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:26.947602034 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:26.955770016 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:26.955832958 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:26.955904007 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:26.957510948 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:26.957536936 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:26.960170984 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:26.960201025 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:26.961317062 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:26.961388111 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.004807949 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.004988909 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.005429029 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.005461931 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.041601896 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.041681051 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.062419891 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.087192059 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.087224960 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.088244915 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.245856047 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.288968086 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.332501888 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.475645065 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.475975037 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.476072073 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.477152109 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.477180004 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.477195024 CEST	49717	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.477200031 CEST	443	49717	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.506778955 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.506827116 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.506836891 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.506882906 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.506912947 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.506927013 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.506937027 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.506978989 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.534657001 CEST	49716	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.534688950 CEST	443	49716	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.635854959 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.635914087 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:27.636126995 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.638206959 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.638219118 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:27.638390064 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.688971043 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.689014912 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.689086914 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.689702034 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.689709902 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.689800024 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.690658092 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.690716028 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.690804005 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.693114042 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.693125963 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.694981098 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.694993973 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.695831060 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:27.695837975 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:27.696573019 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.696604967 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:27.696923018 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:27.696933031 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:27.754595995 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:27.754667997 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:27.812613010 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.812668085 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.812758923 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.813676119 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:27.813692093 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:27.877016068 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:27.877053976 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:27.877403975 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:27.879100084 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:27.879494905 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:27.879517078 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.256238937 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.256318092 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.256407022 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.466985941 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.467089891 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.501523972 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.501558065 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.501574039 CEST	49718	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.501580954 CEST	443	49718	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.502253056 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.509195089 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.509222984 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.509574890 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.517853022 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.523756027 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.523771048 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.524302959 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.524360895 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.525007010 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.525074959 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.525710106 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.525778055 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.526184082 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.526195049 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.550491095 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.550537109 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.550729036 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.550878048 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.550889969 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.551924944 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.552234888 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.552263975 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.552602053 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.552670002 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.553220987 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.553406954 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.553606987 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.553663969 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.564496040 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.598181963 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.598551035 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.598563910 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.599642038 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.599694967 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.600699902 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.600815058 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.600881100 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.602163076 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.602601051 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.602622986 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.603027105 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.603485107 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.603559017 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.603648901 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.634789944 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.635222912 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.635238886 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.635601044 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.636941910 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.637011051 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.637192011 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.644500017 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.648499966 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.667345047 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.667360067 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.667383909 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.684497118 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.702969074 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.703000069 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.746243000 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.746306896 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.746532917 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.747281075 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.747303963 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.747318983 CEST	49724	443	192.168.2.7	184.28.90.27
Aug 26, 2024 00:30:28.747328043 CEST	443	49724	184.28.90.27	192.168.2.7
Aug 26, 2024 00:30:28.810169935 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.811189890 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.811238050 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.811300993 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.811522961 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:28.811534882 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:28.855784893 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.924806118 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.924861908 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.924982071 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.930191040 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.930228949 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.933312893 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.933357954 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.933419943 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.933953047 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.933964968 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.936113119 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.936153889 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.936224937 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.936849117 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:28.936861038 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:28.963979959 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964035988 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964097023 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.964128017 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964164972 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.964171886 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964243889 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964282990 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.964293003 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964390039 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:28.964462996 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.982992887 CEST	49720	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:30:28.983016968 CEST	443	49720	47.254.187.65	192.168.2.7
Aug 26, 2024 00:30:29.350642920 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.366848946 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366873980 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366883993 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366928101 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366942883 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366956949 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366966009 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.366976023 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.366991043 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.367014885 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.367037058 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.367067099 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.367070913 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.367085934 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.367101908 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.367134094 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.378915071 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.378947020 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.439620972 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.439652920 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.439666986 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.439733982 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.439750910 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.439798117 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.441195965 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.441210032 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.441265106 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.441277981 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.492700100 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.492723942 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.492885113 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.492897987 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.498215914 CEST	49721	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.498240948 CEST	443	49721	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.498596907 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.498641968 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.498862982 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.500266075 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.500279903 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.511724949 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.605365038 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.607422113 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.607455969 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.675940990 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.675961018 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.675992012 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.676002979 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.676059008 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.676085949 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.676105022 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.676119089 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.677925110 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.677942991 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.677990913 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.678004980 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.678033113 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.678046942 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.679266930 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.679282904 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.679330111 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.679343939 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.680558920 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.681147099 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.681162119 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.681236029 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.681250095 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.684379101 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.719374895 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.719408035 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.719464064 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.719481945 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.809726000 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.809957981 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.810072899 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.810825109 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.810853004 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.810862064 CEST	49725	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:29.810868025 CEST	443	49725	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:29.821866035 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.821885109 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.821898937 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.821990013 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.822016954 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.822175980 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.828059912 CEST	49671	443	192.168.2.7	204.79.197.203
Aug 26, 2024 00:30:29.832350969 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.832719088 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.832745075 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.833113909 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.833537102 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.833600044 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.833923101 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.845082998 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.846590996 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.846620083 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.847677946 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.847835064 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.848145962 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.848197937 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.848349094 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.851083040 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.854473114 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.854489088 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.854845047 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.860752106 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.860853910 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.860868931 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.876493931 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.888509989 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.908503056 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.911897898 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.911911964 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.911957026 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.911968946 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.911984921 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.912009001 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.912031889 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.913012028 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.913027048 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.913079023 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.913094044 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.913108110 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.913125992 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.914554119 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.914567947 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.914623022 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.914644957 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.914820910 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.915776968 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.915792942 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.915846109 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.915868998 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.915915966 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.917068005 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.917081118 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.917138100 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.917159081 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.917193890 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.918239117 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.918255091 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.918292046 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.918313980 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.918333054 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.918370962 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.919945002 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.919960976 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.920011044 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.920026064 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.920066118 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.965722084 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:29.965743065 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:29.965774059 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.003201962 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.003233910 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.003278017 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.003289938 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.003304958 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.003339052 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.003408909 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.003458977 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.007503986 CEST	49722	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.007539034 CEST	443	49722	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.169868946 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.272905111 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.272916079 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.272959948 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.272999048 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.273024082 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.273051977 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.273098946 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.375967979 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.375993967 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.376049042 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.376066923 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.376122952 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.377105951 CEST	49728	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.377129078 CEST	443	49728	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.390835047 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.390866041 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.390919924 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.390933037 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.390980005 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.391551018 CEST	49729	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.391580105 CEST	443	49729	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.406858921 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.406891108 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.406961918 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.406990051 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.407032013 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.407074928 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.407231092 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.407242060 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.407363892 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.407382965 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.415890932 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.415913105 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.415968895 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.415980101 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.416023016 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.421260118 CEST	49727	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.421282053 CEST	443	49727	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.423737049 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.423774004 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.423830032 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.424056053 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.424069881 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.424694061 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.424711943 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.424776077 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.425318003 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.425331116 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.427278996 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.427285910 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.427625895 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.427776098 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.427788973 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.436440945 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.436641932 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.436651945 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.437679052 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.437745094 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.438127041 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.438183069 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.438308954 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:30.438314915 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:30.486011028 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.669516087 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:31.700193882 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.700203896 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.700237036 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.700347900 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.700372934 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.700397968 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.700493097 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706053972 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706084013 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706106901 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706264973 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706315994 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706350088 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706376076 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706585884 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706585884 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706612110 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706629038 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706789017 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706792116 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.706796885 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706799030 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.706957102 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707151890 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707458973 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.707458973 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.707484961 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707525969 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707551956 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.707706928 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707735062 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.707794905 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707814932 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.707833052 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.707954884 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708096027 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708122969 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708131075 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708142042 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708168983 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708168983 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708173990 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708200932 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708225012 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708225012 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708244085 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708265066 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708621025 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.708693981 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.708944082 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709028959 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709032059 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709045887 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709122896 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709122896 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709136963 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709408045 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709408045 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709418058 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709441900 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709543943 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709551096 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.709630013 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.709636927 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.710263968 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.710282087 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.710350990 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.710350990 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.710357904 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.710681915 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.710798025 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.710990906 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.711055994 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.711076975 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.711203098 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.713386059 CEST	49723	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.713402033 CEST	443	49723	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.716763973 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.716808081 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.716840029 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.716841936 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.716873884 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.716885090 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.717966080 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.717966080 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.718000889 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.718017101 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.718600988 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.718627930 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.718642950 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.718642950 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.718693972 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.719008923 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.719021082 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.719280958 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.719280958 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.719300985 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.719316006 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.719527006 CEST	49731	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.719537973 CEST	443	49731	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.724612951 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.724633932 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.724653959 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.724662066 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.724730015 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.724931002 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.724931955 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.724942923 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.725337029 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.725347996 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.752506018 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:31.758754015 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.758757114 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.758840084 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:31.758840084 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.251285076 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.251362085 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.251420021 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.252216101 CEST	49735	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.252237082 CEST	443	49735	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.254024982 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.254046917 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.254117012 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.254415989 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.254430056 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256208897 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.256251097 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256506920 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.256547928 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256571054 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256623983 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.256633043 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256649017 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.256692886 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.256724119 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.256738901 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.257409096 CEST	49732	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.257415056 CEST	443	49732	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275060892 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275079012 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275136948 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.275151968 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275373936 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.275438070 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275459051 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275501966 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.275511980 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275522947 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275566101 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.275803089 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275868893 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.275990009 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.276479959 CEST	49733	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.276504993 CEST	443	49733	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.279398918 CEST	49736	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.279405117 CEST	443	49736	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.280388117 CEST	49734	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.280396938 CEST	443	49734	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.284775972 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.284799099 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.285052061 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.285389900 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.285406113 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.646488905 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.646759033 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.646778107 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.647681952 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.647746086 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.648575068 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.648628950 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.648721933 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.653529882 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.653568983 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.654087067 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.654690981 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.654702902 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.654896975 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.654927015 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655052900 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.655069113 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655128002 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655319929 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655442953 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655539989 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.655554056 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655778885 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.655844927 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.655896902 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.656044960 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.656122923 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.656779051 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.656845093 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.657546043 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.657609940 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.658160925 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.658225060 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.658571959 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.658622026 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.658878088 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.658924103 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.658932924 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.696497917 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.698872089 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.698888063 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.704493999 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.704505920 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.704514027 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:32.714102983 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:32.748915911 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.150408983 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.153323889 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.153356075 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.154424906 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.154489040 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.155628920 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.155725002 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.156147003 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.156172037 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.190279007 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.190521955 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.190557003 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.190943956 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.191327095 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.191410065 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.191453934 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.195405960 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.195426941 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.195434093 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.195475101 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.195507050 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.195522070 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.195565939 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.197101116 CEST	49737	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.197124958 CEST	443	49737	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.200371981 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.200407982 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.200469017 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.200663090 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.200674057 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.201811075 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.201916933 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.202219963 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.202230930 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.203289032 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.203347921 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.203684092 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.203751087 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.203843117 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.203850031 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.220819950 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.220846891 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.220901012 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.220906019 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.220946074 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.221467018 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.221486092 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.221493006 CEST	49740	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.221514940 CEST	443	49740	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.221530914 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.221538067 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.221580029 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.224462032 CEST	49739	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.224478006 CEST	443	49739	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.225472927 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.225492001 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.225590944 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.225920916 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.225933075 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.227294922 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.227319956 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.227380037 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.227543116 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.227557898 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.232341051 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.232357979 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.246385098 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.394906044 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.394993067 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.395057917 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.397646904 CEST	49738	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.397670984 CEST	443	49738	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.454688072 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.454714060 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.454729080 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.454811096 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.454843044 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.454859018 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.454885006 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.457398891 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.457427025 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.457499027 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.457518101 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.512181044 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.689949036 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.689960957 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.689985037 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.690018892 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.690052986 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.690068007 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.690069914 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.690090895 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.690123081 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.690602064 CEST	49741	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.690618038 CEST	443	49741	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.691200972 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.691241026 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.691299915 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.692905903 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.692919970 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.700181961 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.700201988 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.700247049 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.700258017 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.700270891 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.700313091 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.701417923 CEST	49742	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.701432943 CEST	443	49742	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.720763922 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:33.756946087 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.757025957 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.757066965 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.758328915 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.758409977 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.758517027 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.758874893 CEST	49743	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.758912086 CEST	443	49743	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.759207964 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.759238005 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.759377003 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.760802031 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.760819912 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.766241074 CEST	49744	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:33.766258955 CEST	443	49744	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:33.768507957 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:34.189171076 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.189506054 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.189528942 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.200206995 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.200221062 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.200500011 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.200522900 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.200613022 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.200656891 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.200664043 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.200927019 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.201014996 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.201071978 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.201169968 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.201598883 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.201664925 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.202586889 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.202641010 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.203480959 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.203597069 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.203789949 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.244501114 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.244502068 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.248497963 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.286802053 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:34.286890984 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:34.287024975 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:34.287812948 CEST	49708	443	192.168.2.7	188.114.97.3
Aug 26, 2024 00:30:34.287828922 CEST	443	49708	188.114.97.3	192.168.2.7
Aug 26, 2024 00:30:34.422866106 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:34.422936916 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:34.423001051 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:34.440531969 CEST	49699	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:34.441031933 CEST	49751	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:34.441080093 CEST	443	49751	104.98.116.138	192.168.2.7
Aug 26, 2024 00:30:34.441190958 CEST	49751	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:34.444068909 CEST	49751	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:30:34.444077969 CEST	443	49751	104.98.116.138	192.168.2.7
Aug 26, 2024 00:30:34.445446014 CEST	443	49699	104.98.116.138	192.168.2.7
Aug 26, 2024 00:30:34.598742962 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.599050999 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.599086046 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.600087881 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.600184917 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.600821018 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.600892067 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.600986958 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.648509026 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.652332067 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.653460026 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.663132906 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.663371086 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.663384914 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.664419889 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.664493084 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.664865971 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.664938927 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.665011883 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.673887968 CEST	49712	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:30:34.674096107 CEST	443	49712	142.250.186.100	192.168.2.7
Aug 26, 2024 00:30:34.681689024 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:34.681726933 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:34.681799889 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:34.681988001 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:34.682008028 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:34.698153973 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.712496996 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.714227915 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.714236975 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.728532076 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.728554964 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.728610039 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.728629112 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.728667974 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.728843927 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.734612942 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.734642982 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.734731913 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.735435009 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.735435009 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.755570889 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.755595922 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.755670071 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.755671978 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.755714893 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.761270046 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.885961056 CEST	49745	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.885993004 CEST	443	49745	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.887217045 CEST	49746	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.887224913 CEST	443	49746	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:34.952131033 CEST	49747	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:34.952145100 CEST	443	49747	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.139993906 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.183185101 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.206911087 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.206938028 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.206994057 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:35.207007885 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.207053900 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:35.320846081 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.320938110 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.321002960 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:35.430675983 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.430720091 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.431900024 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.431973934 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.471518040 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.471662998 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.475085974 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.475107908 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.526932955 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.596818924 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.596894979 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.597060919 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.617532015 CEST	49752	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.617558002 CEST	443	49752	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.618494987 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.618522882 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.618590117 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.619020939 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:35.619034052 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:35.676527977 CEST	49749	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:35.676559925 CEST	443	49749	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:35.678239107 CEST	49748	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:35.678270102 CEST	443	49748	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:36.073523045 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.073843002 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.073857069 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.074198008 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.074605942 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.074707985 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.074795008 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.116497993 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.120646954 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.200650930 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.200767040 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:36.200819016 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.203195095 CEST	49753	443	192.168.2.7	35.190.80.1
Aug 26, 2024 00:30:36.203217030 CEST	443	49753	35.190.80.1	192.168.2.7
Aug 26, 2024 00:30:37.371226072 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371247053 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371268988 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371646881 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.371674061 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371777058 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.371833086 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371891975 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.371962070 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.373435974 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.373459101 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.373470068 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.373470068 CEST	49726	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.373477936 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.373483896 CEST	443	49726	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.647690058 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.647723913 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:37.647959948 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.647959948 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:37.647989988 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:38.436826944 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:38.480079889 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:38.574841022 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:38.574858904 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:38.575826883 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:38.575833082 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:38.575889111 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:38.575896978 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096194029 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096219063 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096225977 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096265078 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096288919 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.096302032 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.096333981 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.096873045 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.096884966 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.097023964 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.097042084 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.097074986 CEST	443	49757	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.097126007 CEST	49757	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.164200068 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.164222956 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.164278030 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.164614916 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.164624929 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.951863050 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.952351093 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.952374935 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.952960014 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.952966928 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:40.953010082 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:40.953017950 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367340088 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367371082 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367412090 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367435932 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.367455006 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367482901 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.367732048 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367783070 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.367856026 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.367870092 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.367880106 CEST	49758	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.367883921 CEST	443	49758	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.450782061 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.450826883 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.450947046 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.451256037 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.451267958 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.462990046 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.463037014 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:41.463099003 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.463335991 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:41.463349104 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.244362116 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.244966984 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.244983912 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.245755911 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.245759964 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.245814085 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.245820045 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.246752024 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.246867895 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.255609035 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.255625010 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.255888939 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.256365061 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.256655931 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.256674051 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.666167021 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.666186094 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.666251898 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.666285992 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.666419029 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.666760921 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.666779041 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.666801929 CEST	49760	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.666807890 CEST	443	49760	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.704705000 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.704754114 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.704924107 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.705074072 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.705086946 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792154074 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792176008 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792227030 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792377949 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.792377949 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.792406082 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792701960 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.792813063 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.802464962 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.802488089 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.802519083 CEST	49759	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:42.802524090 CEST	443	49759	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:42.861798048 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:42.861824036 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:42.862304926 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:42.862304926 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:42.862338066 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.493021965 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:43.504911900 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:43.504930019 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:43.514185905 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:43.514199972 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:43.514354944 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:43.514367104 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:43.574354887 CEST	49677	443	192.168.2.7	20.50.201.200
Aug 26, 2024 00:30:43.640455961 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.640517950 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.643631935 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.643640995 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.643889904 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.661401033 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.661475897 CEST	443	49763	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.661572933 CEST	49763	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.806076050 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.806113958 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:43.806174040 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.806808949 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:43.806823015 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:44.156905890 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.156928062 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.156965017 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.157006025 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.157013893 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.157046080 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.157063007 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.157641888 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.157661915 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.157679081 CEST	49762	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.157685041 CEST	443	49762	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.261421919 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.261477947 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.261558056 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.261895895 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:44.261907101 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:44.574290037 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:44.574373007 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:44.578008890 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:44.578021049 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:44.580712080 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:44.621138096 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.072794914 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:45.074080944 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:45.074104071 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:45.254084110 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.254199982 CEST	443	49765	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:45.254254103 CEST	49765	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.399579048 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.399621964 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:45.399730921 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.400562048 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:45.400572062 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:45.754903078 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:45.754935980 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:45.754964113 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:45.754971981 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.104960918 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.104981899 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.105021000 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.105046034 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:46.105057955 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.105071068 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:46.105078936 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.105127096 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:46.106347084 CEST	49766	443	192.168.2.7	40.126.32.72
Aug 26, 2024 00:30:46.106362104 CEST	443	49766	40.126.32.72	192.168.2.7
Aug 26, 2024 00:30:46.190052986 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.190139055 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.191633940 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.191646099 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.191916943 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.246186018 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.411653996 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.411766052 CEST	443	49769	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.411855936 CEST	49769	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.645363092 CEST	49770	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.645405054 CEST	443	49770	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.645564079 CEST	49770	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.646624088 CEST	49770	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:46.646637917 CEST	443	49770	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:46.793191910 CEST	49770	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:47.202390909 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:47.202440977 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:47.202548027 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:47.202979088 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:47.202990055 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:47.994921923 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:47.995065928 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:48.006053925 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:48.006092072 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:48.006438017 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:48.059406996 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:48.367561102 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.367602110 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:48.367742062 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.367868900 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.367875099 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:48.367912054 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.368283987 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.368293047 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:48.368866920 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:48.368875027 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:48.658344030 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:48.658472061 CEST	443	49771	51.104.136.2	192.168.2.7
Aug 26, 2024 00:30:48.658530951 CEST	49771	443	192.168.2.7	51.104.136.2
Aug 26, 2024 00:30:49.273044109 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.308070898 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.326436996 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.358443975 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.594711065 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.594744921 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.594944000 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.594955921 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.595901012 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.595912933 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.595957041 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.596441984 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.596491098 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.597803116 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.597901106 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.598104000 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.598252058 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.598258018 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.599828005 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.653606892 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.655663967 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.655673981 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.708919048 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:49.940359116 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.940453053 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:49.940510035 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:50.960237026 CEST	49774	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:50.960278988 CEST	443	49774	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.054068089 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.097842932 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:51.097889900 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:51.097954035 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:51.098596096 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:51.098608017 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:51.100501060 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.661880016 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.661907911 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.661950111 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.661978960 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.661993980 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.662020922 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.662046909 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.766684055 CEST	49773	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.766721964 CEST	443	49773	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.791629076 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.791675091 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.791791916 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.792131901 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:51.792146921 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:51.893585920 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:51.893657923 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:51.895812988 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:51.895823956 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:51.896078110 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:52.042723894 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:52.100622892 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:52.100719929 CEST	443	49775	51.124.78.146	192.168.2.7
Aug 26, 2024 00:30:52.100828886 CEST	49775	443	192.168.2.7	51.124.78.146
Aug 26, 2024 00:30:52.691590071 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:52.691907883 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:52.691924095 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:52.692281008 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:52.694142103 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:52.694211960 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:52.694345951 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:52.740510941 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:53.234169006 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:53.234199047 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:53.234247923 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:53.234260082 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:53.234272957 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:30:53.234297037 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:53.234328032 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:53.235224009 CEST	49776	443	192.168.2.7	8.218.143.165
Aug 26, 2024 00:30:53.235240936 CEST	443	49776	8.218.143.165	192.168.2.7
Aug 26, 2024 00:31:13.707474947 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:31:13.707518101 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:31:17.149832964 CEST	443	49751	104.98.116.138	192.168.2.7
Aug 26, 2024 00:31:17.149897099 CEST	49751	443	192.168.2.7	104.98.116.138
Aug 26, 2024 00:31:23.930311918 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:23.930350065 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:23.930419922 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:23.940624952 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:23.940638065 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:24.727387905 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:24.762931108 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:24.762947083 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:24.763431072 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:24.808532000 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:24.856906891 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:24.857105017 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:24.902276993 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:28.249397039 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:31:28.249490976 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:31:28.249856949 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:31:29.344420910 CEST	49719	443	192.168.2.7	47.254.187.65
Aug 26, 2024 00:31:29.344455957 CEST	443	49719	47.254.187.65	192.168.2.7
Aug 26, 2024 00:31:35.336312056 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:35.336373091 CEST	443	49780	142.250.186.100	192.168.2.7
Aug 26, 2024 00:31:35.336431980 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:36.283730984 CEST	49780	443	192.168.2.7	142.250.186.100
Aug 26, 2024 00:31:36.283756971 CEST	443	49780	142.250.186.100	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2024 00:30:20.051409960 CEST	53	53534	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:20.076541901 CEST	53	60870	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:21.086149931 CEST	53	64815	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:21.194266081 CEST	50954	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:21.194868088 CEST	64277	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:21.209692955 CEST	53	50954	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:21.211175919 CEST	53	64277	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:23.844789982 CEST	50780	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:23.845478058 CEST	51383	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:23.853457928 CEST	53	50780	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:23.853477955 CEST	53	51383	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:24.048583984 CEST	59618	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:24.048724890 CEST	63626	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:24.216897964 CEST	123	123	192.168.2.7	51.145.123.29
Aug 26, 2024 00:30:24.370162010 CEST	53	59618	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:24.461262941 CEST	53	63626	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:24.755502939 CEST	123	123	51.145.123.29	192.168.2.7
Aug 26, 2024 00:30:25.880240917 CEST	123	123	192.168.2.7	51.145.123.29
Aug 26, 2024 00:30:26.003806114 CEST	49811	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:26.004096031 CEST	54329	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:26.017106056 CEST	53	54329	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:26.017224073 CEST	53	49811	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:26.043781996 CEST	123	123	51.145.123.29	192.168.2.7
Aug 26, 2024 00:30:27.332739115 CEST	58910	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:27.333184958 CEST	60366	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:27.488183022 CEST	53	58910	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:27.646348000 CEST	53	60366	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:30.382311106 CEST	49508	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:30.382567883 CEST	62693	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:30.397893906 CEST	53	62693	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:30.406289101 CEST	53	49508	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:34.674314022 CEST	59078	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:34.674508095 CEST	50030	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:34.680923939 CEST	53	59078	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:34.681368113 CEST	53	50030	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:38.355451107 CEST	53	56333	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:48.345310926 CEST	52925	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:48.345463991 CEST	62957	53	192.168.2.7	1.1.1.1
Aug 26, 2024 00:30:48.360202074 CEST	53	62957	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:48.360215902 CEST	53	52925	1.1.1.1	192.168.2.7
Aug 26, 2024 00:30:57.501086950 CEST	53	50876	1.1.1.1	192.168.2.7
Aug 26, 2024 00:31:19.635740042 CEST	53	57144	1.1.1.1	192.168.2.7
Aug 26, 2024 00:31:19.850208998 CEST	138	138	192.168.2.7	192.168.2.255
Aug 26, 2024 00:31:19.861955881 CEST	53	60443	1.1.1.1	192.168.2.7
Aug 26, 2024 00:31:48.517544985 CEST	53	50457	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 26, 2024 00:30:24.461322069 CEST	192.168.2.7	1.1.1.1	c2c5	(Port unreachable)	Destination Unreachable
Aug 26, 2024 00:30:27.646441936 CEST	192.168.2.7	1.1.1.1	c2c5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 26, 2024 00:30:21.194266081 CEST	192.168.2.7	1.1.1.1	0x725d	Standard query (0)	im16.net	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:21.194868088 CEST	192.168.2.7	1.1.1.1	0x276c	Standard query (0)	im16.net	65	IN (0x0001)	false
Aug 26, 2024 00:30:23.844789982 CEST	192.168.2.7	1.1.1.1	0x46d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:23.845478058 CEST	192.168.2.7	1.1.1.1	0x7a4b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 26, 2024 00:30:24.048583984 CEST	192.168.2.7	1.1.1.1	0x82e7	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:24.048724890 CEST	192.168.2.7	1.1.1.1	0x8b30	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	65	IN (0x0001)	false
Aug 26, 2024 00:30:26.003806114 CEST	192.168.2.7	1.1.1.1	0xcb84	Standard query (0)	im144.mom	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:26.004096031 CEST	192.168.2.7	1.1.1.1	0x95d7	Standard query (0)	im144.mom	65	IN (0x0001)	false
Aug 26, 2024 00:30:27.332739115 CEST	192.168.2.7	1.1.1.1	0x6182	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:27.333184958 CEST	192.168.2.7	1.1.1.1	0xf4dc	Standard query (0)	tretwq.oss-accelerate.aliyuncs.com	65	IN (0x0001)	false
Aug 26, 2024 00:30:30.382311106 CEST	192.168.2.7	1.1.1.1	0x4f65	Standard query (0)	im144.mom	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:30.382567883 CEST	192.168.2.7	1.1.1.1	0xd086	Standard query (0)	im144.mom	65	IN (0x0001)	false
Aug 26, 2024 00:30:34.674314022 CEST	192.168.2.7	1.1.1.1	0xf688	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:34.674508095 CEST	192.168.2.7	1.1.1.1	0x878f	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Aug 26, 2024 00:30:48.345310926 CEST	192.168.2.7	1.1.1.1	0x8fbf	Standard query (0)	im144.mom	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:48.345463991 CEST	192.168.2.7	1.1.1.1	0x19d5	Standard query (0)	im144.mom	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 26, 2024 00:30:21.209692955 CEST	1.1.1.1	192.168.2.7	0x725d	No error (0)	im16.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:21.209692955 CEST	1.1.1.1	192.168.2.7	0x725d	No error (0)	im16.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:21.211175919 CEST	1.1.1.1	192.168.2.7	0x276c	No error (0)	im16.net			65	IN (0x0001)	false
Aug 26, 2024 00:30:23.853457928 CEST	1.1.1.1	192.168.2.7	0x46d5	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:23.853477955 CEST	1.1.1.1	192.168.2.7	0x7a4b	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 26, 2024 00:30:24.370162010 CEST	1.1.1.1	192.168.2.7	0x82e7	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:24.370162010 CEST	1.1.1.1	192.168.2.7	0x82e7	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:24.370162010 CEST	1.1.1.1	192.168.2.7	0x82e7	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:24.370162010 CEST	1.1.1.1	192.168.2.7	0x82e7	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.65	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:24.461262941 CEST	1.1.1.1	192.168.2.7	0x8b30	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:24.461262941 CEST	1.1.1.1	192.168.2.7	0x8b30	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:24.461262941 CEST	1.1.1.1	192.168.2.7	0x8b30	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:26.017224073 CEST	1.1.1.1	192.168.2.7	0xcb84	No error (0)	im144.mom		8.218.143.165	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:27.488183022 CEST	1.1.1.1	192.168.2.7	0x6182	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:27.488183022 CEST	1.1.1.1	192.168.2.7	0x6182	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:27.488183022 CEST	1.1.1.1	192.168.2.7	0x6182	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:27.488183022 CEST	1.1.1.1	192.168.2.7	0x6182	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.65	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:27.646348000 CEST	1.1.1.1	192.168.2.7	0xf4dc	No error (0)	tretwq.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:27.646348000 CEST	1.1.1.1	192.168.2.7	0xf4dc	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:27.646348000 CEST	1.1.1.1	192.168.2.7	0xf4dc	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 26, 2024 00:30:30.406289101 CEST	1.1.1.1	192.168.2.7	0x4f65	No error (0)	im144.mom		8.218.143.165	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:34.680923939 CEST	1.1.1.1	192.168.2.7	0xf688	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Aug 26, 2024 00:30:48.360215902 CEST	1.1.1.1	192.168.2.7	0x8fbf	No error (0)	im144.mom		8.218.143.165	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

im16.net

https:

tretwq.oss-accelerate.aliyuncs.com

im144.mom

fs.microsoft.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49707	188.114.97.3	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:23 UTC	651	OUT	GET / HTTP/1.1 Host: im16.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:23 UTC	621	IN	HTTP/1.1 200 OK Date: Sun, 25 Aug 2024 22:30:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Thu, 18 Jul 2024 06:09:54 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hiz3WF1kBqngPYFFMsWr3Om4il6pEgM%2FBHxfTgKeKsUGhyyE%2FjeptCAriGYPE9u6DWfibQJh0K66tX5V9qIVT07kI%2B7DZujrX2Ju3ocdkioh0oxsWePeSD2xyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b8f06bcbef00f93-EWR alt-svc: h3=":443"; ma=86400
2024-08-25 22:30:23 UTC	640	IN	Data Raw: 32 37 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e6 ad a3 e5 9c a8 e6 89 93 e5 bc 80 e7 ab 99 e7 82 b9 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 25 20 61 75 74 6f 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 30 66 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 25 20 35 25 3b Data Ascii: 279<!doctype html><html><head> <meta charset="utf-8"> <title></title> <style> .container { width: 60%; margin: 10% auto 0; background-color: #f0f0f0; padding: 2% 5%;
2024-08-25 22:30:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49713	47.254.187.65	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:25 UTC	538	OUT	GET /jstz/imdx.js HTTP/1.1 Host: tretwq.oss-accelerate.aliyuncs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://im16.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:25 UTC	626	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 25 Aug 2024 22:30:25 GMT Content-Type: application/javascript Content-Length: 5913 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding x-oss-request-id: 66CBB081E1EC504B1F0C7039 Accept-Ranges: bytes ETag: "C1F1EFB9B2C6142AEB0520984EA62F0A" Last-Modified: Thu, 22 Aug 2024 10:50:25 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 7310312301081958932 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: wfHvubLGFCrrBSCYTqYvCg== x-oss-server-time: 21
2024-08-25 22:30:25 UTC	3470	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 73 53 70 69 64 65 72 28 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 66 6c 61 67 20 3d 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 53 69 74 65 20 3d 20 5b 27 62 61 69 64 75 73 70 69 64 65 72 27 2c 20 27 62 61 69 64 75 2e 27 2c 20 27 33 36 30 53 70 69 64 65 72 27 2c 20 27 73 6f 67 6f 75 2e 27 2c 20 27 73 6f 73 6f 2e 27 2c 20 27 79 69 73 6f 75 73 70 69 64 65 72 27 2c 20 27 62 69 6e 67 62 6f 74 27 2c 20 27 62 69 6e 67 2e 27 2c 20 27 67 6f 6f 67 6c 65 2e 27 2c 20 27 67 6f 6f 67 6c 65 62 6f 74 27 5d 3b 0d 0a 20 20 20 20 66 6f 72 20 28 6c 65 74 20 69 20 3d Data Ascii: function isSpider() { var flag = false; var spider = navigator.userAgent.toLowerCase(); var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot']; for (let i =
2024-08-25 22:30:25 UTC	18	IN	Data Raw: 20 20 20 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0d 0a Data Ascii: } catch (e) {
2024-08-25 22:30:25 UTC	23	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: ret
2024-08-25 22:30:25 UTC	2402	IN	Data Raw: 75 72 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 69 6e 64 52 65 61 64 79 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 35 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 29 28 29 3b 0d 0a 0d 0a 0d 0a 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 73 74 79 6c 65 27 29 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 77 69 64 74 68 20 3d 20 27 31 30 30 25 27 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 6d 61 72 67 69 6e 20 3d 20 30 3b 0d 0a 20 20 20 20 64 6f 63 Data Ascii: urn; } bindReady(); }, 5); } }})();ready(function () { document.body.removeAttribute('style'); document.body.style.width = '100%'; document.body.style.margin = 0; doc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49716	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:27 UTC	664	OUT	GET / HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://im16.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:27 UTC	1197	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6IkVuTitoOXhkTndOUTlJeXhKRmYzQWc9PSIsInZhbHVlIjoiU1BIVXYvZVN3dkw2cDZIbklTWm9TNVdvdGJ3cEV0UDQrSkVXa1YvQ0Z5R2J6YWhxNzVYY1RuRFJZSWxJeDcyUklCZno5Q3RrdFVKTXJ3ZzErQVZtaFlURWlnTVUzRjI4TVJ5Yyt6UnFvNTIwL1luREl2Q0YvcXpwSjd1QWhwNnQiLCJtYWMiOiI1Y2IwOGEwMjMwZDk3Mzc5ZDE0YmM4ODVmM2E2YzA0MmRhNGY0NzcwMzBlNjYyZmEzYWM0OTBkN2UxYTVkMDE4IiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:27 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6IjJ4QVJ6OEVtL0JkSmhmSkNKeWdjdWc9PSIsInZhbHVlIjoidklEV2pvbDNFb2E1Ujk4RnNQQ2dadUNjSlRyYXl3Nko4dVpQNFFUNnVhd1JNUVBDalZsZmc0Tzg1SS9mclhDY0ZkNWR3YVU1dG52V0VwYlRlZTBSeFFSaU9DRDVsQUh1Z0NRQU9YNlZQM205YWx2c3FEZ1BzaXlmSVBVN2QzalkiLCJtYWMiOiJkODk3MmM0MzUyODI2MTZiOTM3YjY4MTNmZjc0OGFkNmZjYTRkMzllZTcyYTU5MGEzZjI3ZjY4OTFlMzE1MWVmIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:27 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-25 22:30:27 UTC	6959	IN	Data Raw: 31 62 32 32 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 61 69 64 75 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 63 6f 64 65 2d 35 49 31 44 56 36 58 45 64 45 22 3e 3c 6d 65 74 61 20 6e 61 Data Ascii: 1b22<html lang="zh-CN"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><meta name="baidu-site-verification" content="code-5I1DV6XEdE"><meta na

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49717	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-25 22:30:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=234599 Date: Sun, 25 Aug 2024 22:30:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49718	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-25 22:30:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:28 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 1561d13e-c19b-43ad-9462-ca84c6e3b1d2 PPServer: PPV: 30 H: SN1PEPF0002F163 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:27 GMT Connection: close Content-Length: 1276
2024-08-25 22:30:28 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-25 22:30:28 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=238512 Date: Sun, 25 Aug 2024 22:30:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-25 22:30:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49720	47.254.187.65	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:28 UTC	370	OUT	GET /jstz/imdx.js HTTP/1.1 Host: tretwq.oss-accelerate.aliyuncs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:28 UTC	625	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 25 Aug 2024 22:30:28 GMT Content-Type: application/javascript Content-Length: 5913 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding x-oss-request-id: 66CBB0846CF4DEABA6F94452 Accept-Ranges: bytes ETag: "C1F1EFB9B2C6142AEB0520984EA62F0A" Last-Modified: Thu, 22 Aug 2024 10:50:25 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 7310312301081958932 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: wfHvubLGFCrrBSCYTqYvCg== x-oss-server-time: 5
2024-08-25 22:30:28 UTC	3471	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 73 53 70 69 64 65 72 28 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 66 6c 61 67 20 3d 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 20 20 20 20 76 61 72 20 73 70 69 64 65 72 53 69 74 65 20 3d 20 5b 27 62 61 69 64 75 73 70 69 64 65 72 27 2c 20 27 62 61 69 64 75 2e 27 2c 20 27 33 36 30 53 70 69 64 65 72 27 2c 20 27 73 6f 67 6f 75 2e 27 2c 20 27 73 6f 73 6f 2e 27 2c 20 27 79 69 73 6f 75 73 70 69 64 65 72 27 2c 20 27 62 69 6e 67 62 6f 74 27 2c 20 27 62 69 6e 67 2e 27 2c 20 27 67 6f 6f 67 6c 65 2e 27 2c 20 27 67 6f 6f 67 6c 65 62 6f 74 27 5d 3b 0d 0a 20 20 20 20 66 6f 72 20 28 6c 65 74 20 69 20 3d Data Ascii: function isSpider() { var flag = false; var spider = navigator.userAgent.toLowerCase(); var spiderSite = ['baiduspider', 'baidu.', '360Spider', 'sogou.', 'soso.', 'yisouspider', 'bingbot', 'bing.', 'google.', 'googlebot']; for (let i =
2024-08-25 22:30:28 UTC	18	IN	Data Raw: 20 20 7d 20 63 61 74 63 68 20 28 65 29 20 7b 0d 0a 20 Data Ascii: } catch (e) {
2024-08-25 22:30:28 UTC	2424	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 69 6e 64 52 65 61 64 79 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 20 35 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 7d 29 28 29 3b 0d 0a 0d 0a 0d 0a 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 73 74 79 6c 65 27 29 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c 65 2e 77 69 64 74 68 20 3d 20 27 31 30 30 25 27 3b 0d 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 73 74 79 6c Data Ascii: return; } bindReady(); }, 5); } }})();ready(function () { document.body.removeAttribute('style'); document.body.style.width = '100%'; document.body.styl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49721	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:28 UTC	538	OUT	GET /images/swiper.min.css HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:29 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:28 GMT Content-Type: text/css Content-Length: 19552 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:13 GMT ETag: "65faaa89-4c60" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:29 UTC	16088	IN	Data Raw: 0a 20 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 6e 6f 2d 66 6c 65 78 62 6f 78 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d Data Ascii: .swiper-container{margin:0 auto;position:relative;overflow:hidden;list-style:none;padding:0;z-index:1}.swiper-container-no-flexbox .swiper-slide{float:left}.swiper-container-vertical>.swiper-wrapper{-webkit-box-orient:vertical;-webkit-box-direction:norm
2024-08-25 22:30:29 UTC	3464	IN	Data Raw: 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 33 37 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 31 38 30 25 32 30 36 30 25 32 43 36 30 29 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 34 36 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 32 31 30 25 32 30 36 30 25 32 43 36 30 29 27 25 32 46 25 33 45 25 33 43 75 73 65 25 32 30 78 6c 69 6e 6b 25 33 41 68 72 65 66 25 33 44 27 25 32 33 6c 27 25 32 30 6f 70 61 63 69 74 79 25 33 44 27 2e 35 36 27 25 32 30 74 72 61 6e 73 66 6f 72 6d 25 33 44 27 72 6f 74 61 74 65 28 32 34 30 25 32 30 36 30 25 Data Ascii: xlink%3Ahref%3D'%23l'%20opacity%3D'.37'%20transform%3D'rotate(180%2060%2C60)'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.46'%20transform%3D'rotate(210%2060%2C60)'%2F%3E%3Cuse%20xlink%3Ahref%3D'%23l'%20opacity%3D'.56'%20transform%3D'rotate(240%2060%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49723	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:28 UTC	532	OUT	GET /images/ccc8.css HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:29 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:28 GMT Content-Type: text/css Content-Length: 80757 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:07 GMT ETag: "65faaa83-13b75" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:29 UTC	16087	IN	Data Raw: 2e 61 6e 74 2d 63 61 72 64 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 35 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 74 61 62 75 6c 61 72 2d 6e 75 6d 73 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 27 74 6e 75 6d 27 3b 66 6f 6e 74 2d 66 65 61 74 75 72 65 2d 73 65 74 74 69 6e 67 73 3a 27 74 6e 75 6d 27 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c Data Ascii: .ant-card{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0;color:rgba(0,0,0,0.65);font-size:14px;font-variant:tabular-nums;line-height:1.5;list-style:none;-webkit-font-feature-settings:'tnum';font-feature-settings:'tnum';position:rel
2024-08-25 22:30:30 UTC	16384	IN	Data Raw: 6e 2d 6c 65 66 74 20 2e 33 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 34 35 2c 30 2e 30 34 35 2c 30 2e 33 35 35 2c 31 29 3b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 6d 61 72 67 69 6e 2d 6c 65 66 74 7d 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 6c 65 66 74 2d 62 61 72 2c 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 72 69 67 68 74 2d 62 61 72 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 6c 65 66 74 2d 62 61 72 20 2e 61 6e 74 2d 74 61 62 73 2d 74 61 62 2d 61 72 72 6f 77 2d 73 68 6f 77 2c 2e 61 6e 74 2d 74 61 62 73 20 2e 61 6e 74 2d 74 61 62 73 2d 72 69 67 68 74 2d 62 61 72 20 2e 61 6e 74 2d 74 61 62 73 2d 74 61 62 2d 61 Data Ascii: n-left .3s cubic-bezier(0.645,0.045,0.355,1);will-change:margin-left}.ant-tabs .ant-tabs-left-bar,.ant-tabs .ant-tabs-right-bar{height:100%;border-bottom:0}.ant-tabs .ant-tabs-left-bar .ant-tabs-tab-arrow-show,.ant-tabs .ant-tabs-right-bar .ant-tabs-tab-a
2024-08-25 22:30:31 UTC	16384	IN	Data Raw: 6f 6c 2d 78 73 2d 70 75 6c 6c 2d 32 33 7b 72 69 67 68 74 3a 39 35 2e 38 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 6f 66 66 73 65 74 2d 32 33 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 6f 72 64 65 72 2d 32 33 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 32 34 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 32 33 3b 6f 72 64 65 72 3a 32 33 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 73 2d 32 32 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 39 31 2e 36 36 36 36 36 36 36 37 Data Ascii: ol-xs-pull-23{right:95.83333333%}.ant-col-xs-offset-23{margin-left:95.83333333%}.ant-col-xs-order-23{-webkit-box-ordinal-group:24;-ms-flex-order:23;order:23}.ant-col-xs-22{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:91.66666667
2024-08-25 22:30:31 UTC	16384	IN	Data Raw: 66 73 65 74 2d 31 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 39 2e 31 36 36 36 36 36 36 37 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 6f 72 64 65 72 2d 31 39 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 32 30 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 31 39 3b 6f 72 64 65 72 3a 31 39 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 31 38 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 37 35 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 31 38 7b 6c 65 66 74 3a 37 35 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 6d 64 2d 70 75 6c 6c 2d 31 38 7b 72 69 67 68 74 Data Ascii: fset-19{margin-left:79.16666667%}.ant-col-md-order-19{-webkit-box-ordinal-group:20;-ms-flex-order:19;order:19}.ant-col-md-18{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:75%}.ant-col-md-push-18{left:75%}.ant-col-md-pull-18{right
2024-08-25 22:30:31 UTC	15518	IN	Data Raw: 36 3b 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 31 35 3b 6f 72 64 65 72 3a 31 35 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 31 34 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 70 75 73 68 2d 31 34 7b 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 70 75 6c 6c 2d 31 34 7b 72 69 67 68 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 6e 74 2d 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 31 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 61 Data Ascii: 6;-ms-flex-order:15;order:15}.ant-col-xl-14{display:block;-webkit-box-sizing:border-box;box-sizing:border-box;width:58.33333333%}.ant-col-xl-push-14{left:58.33333333%}.ant-col-xl-pull-14{right:58.33333333%}.ant-col-xl-offset-14{margin-left:58.33333333%}.a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49722	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:28 UTC	532	OUT	GET /images/111f.css HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:29 UTC	298	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:29 GMT Content-Type: text/css Content-Length: 230780 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:00 GMT ETag: "65faaa7c-3857c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:29 UTC	16086	IN	Data Raw: 62 6f 64 79 2c 68 74 6d 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 69 6e 70 75 74 3a 3a 2d 6d 73 2d 63 6c 65 61 72 2c 69 6e 70 75 74 3a 3a 2d 6d 73 2d 72 65 76 65 61 6c 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2a 2c 3a 3a 61 66 74 65 72 2c 3a 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d Data Ascii: body,html{width:100%;height:100%}input::-ms-clear,input::-ms-reveal{display:none}*,::after,::before{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;-m
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 30 66 66 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 23 31 38 39 30 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 36 70 78 20 76 61 72 28 2d 2d 61 6e 74 64 2d 77 61 76 65 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 36 70 78 20 76 61 72 28 2d 2d 61 6e 74 64 2d 77 61 76 65 2d 73 68 61 64 6f 77 2d 63 6f 6c 6f 72 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 45 66 66 65 63 74 7b 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 45 66 66 65 63 74 7b 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 2e 73 6c 69 64 65 2d 75 70 2d 61 70 70 65 61 72 2c 2e 73 6c 69 64 65 2d 75 70 2d 65 6e 74 65 Data Ascii: 0ff;box-shadow:0 0 0 #1890ff;-webkit-box-shadow:0 0 0 6px var(--antd-wave-shadow-color);box-shadow:0 0 0 6px var(--antd-wave-shadow-color)}}@-webkit-keyframes fadeEffect{100%{opacity:0}}@keyframes fadeEffect{100%{opacity:0}}.slide-up-appear,.slide-up-ente
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 49 6e 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 49 6e 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 79 2d 73 74 61 74 65 3a 72 75 6e 6e 69 6e 67 3b 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 79 2d 73 74 61 74 65 3a 72 75 6e 6e 69 6e 67 7d 2e 7a 6f 6f 6d 2d 6c 65 66 74 2d 6c 65 61 76 65 2e 7a 6f 6f 6d 2d 6c 65 66 74 2d 6c 65 61 76 65 2d 61 63 74 69 76 65 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 4f 75 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 61 6e 74 5a 6f 6f 6d 4c 65 66 74 4f 75 74 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 70 6c 61 Data Ascii: t-animation-name:antZoomLeftIn;animation-name:antZoomLeftIn;-webkit-animation-play-state:running;animation-play-state:running}.zoom-left-leave.zoom-left-leave-active{-webkit-animation-name:antZoomLeftOut;animation-name:antZoomLeftOut;-webkit-animation-pla
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 3a 70 6f 69 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 63 6f 6d 6d 6f 6e 2d 66 6f 6f 74 65 72 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6c 69 6e 6b 73 2d 69 74 65 6d 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 39 31 63 31 65 7d 2e 73 75 62 73 63 72 69 62 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 73 75 62 73 63 72 69 62 65 20 2e 73 75 62 73 63 72 69 62 65 2d 69 6e 70 75 74 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 32 66 34 66 35 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 6f 75 74 6c 69 6e 65 3a 30 3b 70 61 64 64 69 6e 67 3a 30 20 34 30 70 78 20 30 20 32 30 70 78 3b 68 65 69 67 Data Ascii: :pointer;text-decoration:none}.common-footer .nav-links .links-item a:hover{color:#191c1e}.subscribe{position:relative;margin-top:10px}.subscribe .subscribe-input{border-radius:20px;background-color:#f2f4f5;border:none;outline:0;padding:0 40px 0 20px;heig
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 6f 6e 74 61 63 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 62 66 63 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 68 6f 6d 65 2d 70 61 67 65 20 2e 63 6f 6e 74 61 63 74 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 6e 65 72 7b 77 69 64 74 68 3a 31 31 36 38 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 31 30 30 70 78 20 30 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 38 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 68 6f 6d 65 2d 70 61 67 65 20 2e 63 6f 6e 74 61 63 74 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 6e 65 Data Ascii: ontact{width:100%;background-color:#fafbfc;background-color:#fff}.home-page .contact .contact-inner{width:1168px;margin:0 auto;padding:100px 0;padding-top:80px;padding-bottom:60px}@media only screen and (max-width:1024px){.home-page .contact .contact-inne
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 78 29 7b 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 31 36 70 78 7d 7d 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 39 30 70 78 7d 2e 74 6f 6b 65 6e 6c 6f 6e 2d 70 61 67 65 20 2e 77 6f 72 6b 20 2e 77 6f 72 6b 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 72 6b 2d 70 69 63 74 75 72 65 2e 64 65 73 6b 74 6f 70 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 74 6f 6b 65 6e 6c Data Ascii: x){.tokenlon-page .work .work-title{font-size:32px;padding:0 16px}}.tokenlon-page .work .work-container{display:flex;justify-content:center;align-items:center;margin-top:90px}.tokenlon-page .work .work-container .work-picture.desktop{display:block}.tokenl
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 33 70 78 3b 74 6f 70 3a 2d 33 70 78 3b 77 69 64 74 68 3a 35 70 78 3b 68 65 69 67 68 74 3a 35 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 61 62 6f 75 74 2d 70 61 67 65 20 2e 65 76 65 6e 74 73 20 2e 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 20 2e 62 69 67 2d 65 76 65 6e 74 73 20 2e 65 76 65 6e 74 2d 6c 69 6e 65 20 2e 65 76 65 6e 74 2d 64 65 73 63 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 7d 2e 61 62 6f 75 74 2d 70 61 67 65 20 2e 65 76 65 6e 74 73 20 2e 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 20 2e 62 69 67 2d 65 76 65 6e 74 73 20 2e 65 76 65 6e 74 2d 6c 69 6e 65 20 2e 65 76 65 6e 74 2d 64 65 73 63 20 2e 65 76 65 6e 74 2d 74 69 74 6c 65 7b 6d 61 78 2d 77 69 64 74 68 Data Ascii: 3px;top:-3px;width:5px;height:5px;background-color:#000;border-radius:50%}.about-page .events .section-inner .big-events .event-line .event-desc{padding-left:5px}.about-page .events .section-inner .big-events .event-line .event-desc .event-title{max-width
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 6f 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6d 6d 73 6c 69 64 65 49 6e 7b 66 72 6f 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 35 25 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6d 6d 73 6c 69 64 65 4f 75 74 7b 66 72 6f 6d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 31 30 25 29 7d 7d 2e 6d 69 63 72 6f 6d 6f 64 61 6c 2d 73 6c 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 6d 69 63 72 6f 6d 6f 64 61 6c 2d 73 6c 69 64 65 2e 69 73 2d 6f 70 65 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 6d 69 63 72 6f 6d 6f 64 Data Ascii: o{opacity:0}}@keyframes mmslideIn{from{transform:translateY(15%)}to{transform:translateY(0)}}@keyframes mmslideOut{from{transform:translateY(0)}to{transform:translateY(-10%)}}.micromodal-slide{display:none}.micromodal-slide.is-open{display:block}.micromod
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 64 69 6e 67 3a 31 32 34 70 78 20 30 20 39 36 70 78 20 30 7d 2e 62 72 61 6e 64 2d 70 61 67 65 20 2e 64 65 73 63 2d 73 65 63 74 69 6f 6e 20 2e 64 65 73 63 2d 69 6e 6e 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 31 36 38 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 20 6e 6f 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 62 72 61 6e 64 2d 70 61 67 65 20 2e 64 65 73 63 2d 73 65 63 74 69 6f 6e 20 2e 64 65 73 63 2d 69 6e 6e 65 72 20 2e 6f 2d 64 6f 77 6e 6c 6f 61 64 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 Data Ascii: ding:124px 0 96px 0}.brand-page .desc-section .desc-inner{width:100%;max-width:1168px;margin:0 auto;display:flex;flex-flow:row nowrap;align-items:center;justify-content:space-between}.brand-page .desc-section .desc-inner .o-download{display:inline-block;w
2024-08-25 22:30:29 UTC	16384	IN	Data Raw: 65 72 2c 2e 61 6e 74 2d 62 74 6e 5b 64 69 73 61 62 6c 65 64 5d 3e 61 3a 6f 6e 6c 79 2d 63 68 69 6c 64 3a 3a 61 66 74 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 63 6f 6e 74 65 6e 74 3a 27 27 7d 2e 61 6e 74 2d 62 74 6e 2e 61 63 74 69 76 65 2c 2e 61 6e 74 2d 62 74 6e 3a 61 63 74 69 76 65 2c 2e 61 6e 74 2d 62 74 6e 3a 66 6f 63 75 73 2c 2e 61 6e 74 2d 62 74 6e 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 7d 2e 61 6e 74 2d 62 74 6e 3e 69 2c 2e 61 6e 74 2d 62 74 6e 3e 73 70 61 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d Data Ascii: er,.ant-btn[disabled]>a:only-child::after{position:absolute;top:0;right:0;bottom:0;left:0;background:0 0;content:''}.ant-btn.active,.ant-btn:active,.ant-btn:focus,.ant-btn:hover{text-decoration:none;background:#fff}.ant-btn>i,.ant-btn>span{display:inline-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49725	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-25 22:30:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: de830b5f-7bbb-4835-a3de-d5a621b722d2 PPServer: PPV: 30 H: SN1PEPF0002FA9D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:29 GMT Connection: close Content-Length: 1276
2024-08-25 22:30:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49726	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:29 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-08-25 22:30:29 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 73 63 75 78 76 6f 76 6b 6c 66 68 72 71 6f 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 76 67 78 62 72 46 47 28 2f 43 65 3f 34 79 46 2f 6f 2e 50 38 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02scuxvovklfhrqo</Membername><Password>vgxbrFG(/Ce?4yF/o.P8</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-08-25 22:30:37 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sun, 25 Aug 2024 22:29:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: 3f25e9fd-e36a-429b-9aff-e06662f92771 PPServer: PPV: 30 H: SN1PEPF0002F1B1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:36 GMT Connection: close Content-Length: 17166
2024-08-25 22:30:37 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 30 46 32 44 33 32 33 36 30 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 66 65 39 36 66 31 34 36 2d 66 35 35 38 2d 34 66 38 33 2d 62 30 32 66 2d 35 62 62 30 30 66 63 39 30 66 38 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018800F2D32360F</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="fe96f146-f558-4f83-b02f-5bb00fc90f8f" LicenseID="3252b20c-d425-4711
2024-08-25 22:30:37 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49728	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:29 UTC	585	OUT	GET /images/bdTokenLogo.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:30 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:30 GMT Content-Type: image/png Content-Length: 2134 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:06 GMT ETag: "65faaa82-856" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:30 UTC	2134	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 12 08 06 00 00 00 51 8c 50 42 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 07 e4 49 44 41 54 58 c3 ed 99 79 4c 54 47 1c c7 57 f6 7c ec bd 78 b4 6a 1b 63 3d f6 40 34 a5 ad f2 de c3 92 c6 d0 a2 35 31 b6 fe e1 95 b4 e9 91 5e 1e 28 9e 78 e0 ad 45 aa 52 0f 14 ef 5b d4 8a 1c cb b2 c0 2e a7 80 28 4a 8d 6d 9a b4 56 db f4 48 d5 a8 f5 4e 85 e9 6f de 9b b7 bc 7d b0 b0 80 06 4d 7c c9 64 77 67 e6 cd f5 99 ef 6f 7e bf 59 99 ec 71 3d 5e af c2 e4 a9 1d 6c f6 9e 9f 64 2a a9 9b 66 29 af fb d8 72 ea 02 2d 7b fe 3c 7d 8f ce 59 65 37 3a cf 6c 33 ba 6a af 1b 0b 6a 91 a9 08 92 f7 1c 32 95 9c 47 e6 b2 ba ab c1 b4 61 70 44 f5 b3 58 e9 4f cc 7d 23 8d 4f fb 7c 2d fd 86 1a 8c 56 36 d2 6c a3 c3 3b 7f Data Ascii: PNGIHDRmQPBbKGDIDATXyLTGW\|xjc=@451^(xER[.(JmVHNo}M\|dwgo~Yq=^ld*f)r-{<}Ye7:l3jj2GapDXO}#O\|-V6l;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49729	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:29 UTC	579	OUT	GET /images/bdapk.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:30 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:30 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:30 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49727	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:29 UTC	578	OUT	GET /images/bdpg.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:30 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:30 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:30 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49731	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:30 UTC	580	OUT	GET /images/banner.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:31 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:30 GMT Content-Type: image/png Content-Length: 46217 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:04 GMT ETag: "65faaa80-b489" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:31 UTC	16087	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 e8 00 00 03 e8 08 03 00 00 00 7a 7d 24 d6 00 00 02 fa 50 4c 54 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 06 92 c3 fb fb fc f9 f9 fa 47 40 6a 30 32 46 42 c6 67 2a 80 ea fa c1 66 e2 69 61 3c c6 8a fa fb fb fc fc fd f9 f9 fc f7 f8 fc fd fd fe f7 f8 fa 00 00 00 f9 fa fd 39 a6 d0 63 d1 a1 e8 87 81 f4 f5 fb f1 f3 fa 1f 1f 1f fb fc fe fb cd 85 6c 66 88 55 99 ee 59 5b 6b 68 d1 85 f5 f6 fb 2b a2 cc cc cc cc ee f1 f9 43 45 4f 7d 7d 7d 59 cf 9c 5e cf 7e fb ca 7d 4a 93 ed c9 ca ca ef ef f0 63 5d 80 4f 51 62 e6 80 79 f2 f3 f4 a8 a8 b5 df df e0 ed ed ef d9 d9 da ef f1 f4 f4 f4 f6 f4 f5 f8 e8 e8 ea e1 e2 e4 f4 b7 31 f6 f7 f8 60 b9 d8 27 75 ca b5 Data Ascii: PNGIHDRz}$PLTEG@j02FBg*fia<9clfUY[kh+CEO}}}Y^~}Jc]OQby1`'u
2024-08-25 22:30:31 UTC	16384	IN	Data Raw: af c8 1b 00 5e ca eb 23 b9 2d 8c b0 0d 67 87 38 51 77 49 11 80 ec 91 ae 7b ce 31 bf 46 4b 53 40 cd 68 06 bb ee 4d 80 68 16 b1 6d 02 68 0a 83 69 64 65 5f 1c 88 4d 39 f8 d8 75 36 b7 40 39 f8 16 29 7a 7c c3 cc 69 17 fd d2 9f 8a 1e 1d 8c 13 33 72 03 0e 79 5d 5d b8 6c 9a cb 95 b6 6a ce ce ea fc cb 4a c6 54 af 63 cd 34 33 cf 6e a8 99 24 f0 4c be b7 3c 77 5b 57 33 95 b6 69 e6 47 41 37 01 23 38 cd 90 6c 5b 33 2c 82 ef ec 9d 4d 6b 13 41 18 c7 55 14 94 87 2e 81 c0 64 98 78 13 c1 83 8c 50 2c 12 1b 5b 5b f6 60 89 c5 57 50 63 a3 d8 10 57 83 b6 0a cd a1 3d b4 a5 34 f4 56 0f 5b 2c 18 a8 c5 52 d4 de 8b 5e 2a 5e 4a af bd 7a 29 81 7e 03 3f 81 b3 2f 76 93 75 b3 9b d4 84 66 36 cf af 69 d3 dd ae 39 08 3f 9e ff 3e 33 b3 d3 27 1a 6c 5b 46 ef cd 69 c6 2d 6e 89 13 fd 42 ed 8f da Data Ascii: ^#-g8QwI{1FKS@hMhmhide_M9u6@9)z\|i3ry]]ljJTc43n$L<w[W3iGA7#8l[3,MkAU.dxP,[[`WPcW=4V[,R^*^Jz)~?/vuf6i9?>3'l[Fi-nB
2024-08-25 22:30:31 UTC	13746	IN	Data Raw: e4 77 20 51 14 c9 47 07 d1 c7 69 2d 1e 15 1d 3e f3 a5 77 97 45 ff f7 33 dc 5f 74 7b b0 96 ae f7 5e 5b 18 f7 5e e3 3d d2 27 d3 88 43 29 0a 09 fa 6b 8c 6c 8b 40 40 db 69 f2 7a 1c 85 c6 0a 00 2c 1d 87 81 11 3d 16 21 be 75 ab 34 55 f2 2a 7a b0 25 13 e3 03 57 fd 6e 0c 6e 15 ce 1f d0 4d 55 05 4b f5 05 7b 37 55 e0 dd 54 6f 43 ba 20 94 a2 23 8d b7 c3 5b 8d 1d 09 d4 42 15 0c b6 56 20 56 10 01 d2 45 11 4c 02 c5 97 00 2b a5 74 a3 91 40 4e db 6b d6 91 19 4f 2e c6 31 3e fd 17 e2 23 78 17 44 0f fd fb e1 13 58 b8 d3 1f 1d 8d fa a3 23 de 1f fd 96 48 ab c7 bf 8d b4 dd f9 a5 b1 13 6b 14 84 48 41 06 83 f5 92 61 f5 71 21 5f 50 81 b1 53 00 40 5b c7 a5 58 fa b8 84 9c 8e c0 52 44 4f 9e 8c e3 3c 02 2e 88 0e a8 2a 23 87 bb 2d 19 38 8e 68 8d 62 be 21 80 41 a2 34 03 20 14 d3 63 d1 Data Ascii: w QGi->wE3_t{^[^='C)kl@@iz,=!u4Uz%WnnMUK{7UToC #[BV VEL+t@NkO.1>#xDX#HkHAaq!_PS@[XRDO<.#-8hb!A4 c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49735	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:31 UTC	578	OUT	GET /images/menu.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:32 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:32 GMT Content-Type: image/png Content-Length: 198 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:10 GMT ETag: "65faaa86-c6" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:32 UTC	198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 1a 04 03 00 00 00 5b 64 51 fd 00 00 00 18 50 4c 54 45 00 00 00 36 3b 4e 36 3d 4c 36 3c 4d 36 3c 4d 36 3c 4d 36 3c 4d ff ff ff e0 ca aa 6c 00 00 00 06 74 52 4e 53 00 6c 75 77 88 e1 1b 6c 73 0b 00 00 00 01 62 4b 47 44 07 16 61 88 eb 00 00 00 23 49 44 41 54 18 d3 63 60 a0 0e 60 4d 83 81 00 06 da 00 46 63 18 10 00 f2 98 5c 60 40 81 46 f6 51 df 47 00 a9 3f 0c 39 db d5 8b 93 00 00 00 00 49 45 4e 44 ae 42 60 82 5b 5b 2a 41 54 2a 5d 38 30 30 46 46 44 43 31 44 30 32 46 34 36 43 41 38 31 35 32 46 41 30 31 32 39 44 31 37 45 41 30 Data Ascii: PNGIHDR[dQPLTE6;N6=L6<M6<M6<M6<MltRNSluwlsbKGDa#IDATc``MFc\`@FQG?9IENDB`[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49733	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:31 UTC	355	OUT	GET /images/bdTokenLogo.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:32 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:32 GMT Content-Type: image/png Content-Length: 2134 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:06 GMT ETag: "65faaa82-856" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:32 UTC	2134	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 12 08 06 00 00 00 51 8c 50 42 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 07 e4 49 44 41 54 58 c3 ed 99 79 4c 54 47 1c c7 57 f6 7c ec bd 78 b4 6a 1b 63 3d f6 40 34 a5 ad f2 de c3 92 c6 d0 a2 35 31 b6 fe e1 95 b4 e9 91 5e 1e 28 9e 78 e0 ad 45 aa 52 0f 14 ef 5b d4 8a 1c cb b2 c0 2e a7 80 28 4a 8d 6d 9a b4 56 db f4 48 d5 a8 f5 4e 85 e9 6f de 9b b7 bc 7d b0 b0 80 06 4d 7c c9 64 77 67 e6 cd f5 99 ef 6f 7e bf 59 99 ec 71 3d 5e af c2 e4 a9 1d 6c f6 9e 9f 64 2a a9 9b 66 29 af fb d8 72 ea 02 2d 7b fe 3c 7d 8f ce 59 65 37 3a cf 6c 33 ba 6a af 1b 0b 6a 91 a9 08 92 f7 1c 32 95 9c 47 e6 b2 ba ab c1 b4 61 70 44 f5 b3 58 e9 4f cc 7d 23 8d 4f fb 7c 2d fd 86 1a 8c 56 36 d2 6c a3 c3 3b 7f Data Ascii: PNGIHDRmQPBbKGDIDATXyLTGW\|xjc=@451^(xER[.(JmVHNo}M\|dwgo~Yq=^ld*f)r-{<}Ye7:l3jj2GapDXO}#O\|-V6l;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49734	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:31 UTC	579	OUT	GET /images/alarm.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:32 UTC	271	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:32 GMT Content-Type: image/png Content-Length: 574 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-23e" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:32 UTC	574	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 cf 50 4c 54 45 00 00 00 80 80 bf 80 aa aa 9f 9f 9f 8e aa aa 8b a2 a2 99 99 aa 92 9e aa 90 9b a6 99 99 a3 97 a1 aa 92 9b a4 91 a2 aa 97 9f a7 95 9d a6 92 9f a7 93 9d a8 94 9e a5 93 9f a6 94 9d a7 93 9e a6 94 9f a7 95 9d a5 94 9e a6 95 9f a7 94 9e a5 95 9e a6 94 9d a7 95 9e a5 94 9f a5 95 9d a6 93 9e a6 94 9e a7 95 9d a5 94 9e a6 95 9f a7 94 9e a6 94 9e a7 93 9d a6 94 9e a6 93 9e a6 94 9d a5 94 9e a5 95 9e a7 94 9e a6 94 9e a6 94 9e a7 94 9e a6 94 9e a5 95 9e a6 94 9e a6 94 9d a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 ff ff ff 11 0f 32 85 00 00 00 Data Ascii: PNGIHDRPLTE2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49732	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:31 UTC	349	OUT	GET /images/bdapk.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:32 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:32 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:32 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49736	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:31 UTC	348	OUT	GET /images/bdpg.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:32 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:32 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:05 GMT ETag: "65faaa81-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:32 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49737	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:32 UTC	582	OUT	GET /images/ewm_icon.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 5040 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-13b0" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	5040	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 13 50 49 44 41 54 78 5e ed 9d 5d 72 13 c7 16 c7 4f 0f 15 ee 7d bb dc 15 c4 54 85 19 bf c5 3c 58 e4 0d bc 82 98 15 10 af 20 66 05 38 2b 08 ac 00 b3 82 98 15 60 bf 81 fc 10 f1 26 8d 53 15 79 05 31 6f 68 1c cf b9 d5 f2 28 e8 62 6b fa f4 c7 8c 7a a4 ff 54 a5 52 94 fb f3 7f fa d7 a7 bf d4 ad 08 1f 14 80 02 0b 15 50 d0 06 0a 40 81 c5 0a 00 10 b4 0e 28 50 a3 00 00 41 f3 80 02 00 04 6d 00 0a b8 29 00 0f e2 a6 1b 62 ad 89 02 00 64 4d 0c 8d 6a ba 29 00 40 dc 74 43 ac 35 51 00 80 ac 89 a1 51 4d 37 05 00 88 9b 6e 88 b5 26 0a 00 90 35 31 34 aa e9 a6 00 00 71 d3 0d b1 d6 44 81 c6 00 d9 dc fc 61 83 fe be fa 56 eb 58 26 ea c9 aa e8 a9 94 1a a8 ab f2 e2 4a d1 a7 b3 b3 Data Ascii: PNGIHDRXPIDATx^]rO}T<X f8+`&Sy1oh(bkzTRP@(PAm)bdMj)@tC5QQM7n&514qDaVX&J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49741	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:32 UTC	350	OUT	GET /images/banner.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	297	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 46217 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:04 GMT ETag: "65faaa80-b489" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	16087	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 e8 00 00 03 e8 08 03 00 00 00 7a 7d 24 d6 00 00 02 fa 50 4c 54 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 06 92 c3 fb fb fc f9 f9 fa 47 40 6a 30 32 46 42 c6 67 2a 80 ea fa c1 66 e2 69 61 3c c6 8a fa fb fb fc fc fd f9 f9 fc f7 f8 fc fd fd fe f7 f8 fa 00 00 00 f9 fa fd 39 a6 d0 63 d1 a1 e8 87 81 f4 f5 fb f1 f3 fa 1f 1f 1f fb fc fe fb cd 85 6c 66 88 55 99 ee 59 5b 6b 68 d1 85 f5 f6 fb 2b a2 cc cc cc cc ee f1 f9 43 45 4f 7d 7d 7d 59 cf 9c 5e cf 7e fb ca 7d 4a 93 ed c9 ca ca ef ef f0 63 5d 80 4f 51 62 e6 80 79 f2 f3 f4 a8 a8 b5 df df e0 ed ed ef d9 d9 da ef f1 f4 f4 f4 f6 f4 f5 f8 e8 e8 ea e1 e2 e4 f4 b7 31 f6 f7 f8 60 b9 d8 27 75 ca b5 Data Ascii: PNGIHDRz}$PLTEG@j02FBg*fia<9clfUY[kh+CEO}}}Y^~}Jc]OQby1`'u
2024-08-25 22:30:33 UTC	16384	IN	Data Raw: af c8 1b 00 5e ca eb 23 b9 2d 8c b0 0d 67 87 38 51 77 49 11 80 ec 91 ae 7b ce 31 bf 46 4b 53 40 cd 68 06 bb ee 4d 80 68 16 b1 6d 02 68 0a 83 69 64 65 5f 1c 88 4d 39 f8 d8 75 36 b7 40 39 f8 16 29 7a 7c c3 cc 69 17 fd d2 9f 8a 1e 1d 8c 13 33 72 03 0e 79 5d 5d b8 6c 9a cb 95 b6 6a ce ce ea fc cb 4a c6 54 af 63 cd 34 33 cf 6e a8 99 24 f0 4c be b7 3c 77 5b 57 33 95 b6 69 e6 47 41 37 01 23 38 cd 90 6c 5b 33 2c 82 ef ec 9d 4d 6b 13 41 18 c7 55 14 94 87 2e 81 c0 64 98 78 13 c1 83 8c 50 2c 12 1b 5b 5b f6 60 89 c5 57 50 63 a3 d8 10 57 83 b6 0a cd a1 3d b4 a5 34 f4 56 0f 5b 2c 18 a8 c5 52 d4 de 8b 5e 2a 5e 4a af bd 7a 29 81 7e 03 3f 81 b3 2f 76 93 75 b3 9b d4 84 66 36 cf af 69 d3 dd ae 39 08 3f 9e ff 3e 33 b3 d3 27 1a 6c 5b 46 ef cd 69 c6 2d 6e 89 13 fd 42 ed 8f da Data Ascii: ^#-g8QwI{1FKS@hMhmhide_M9u6@9)z\|i3ry]]ljJTc43n$L<w[W3iGA7#8l[3,MkAU.dxP,[[`WPcW=4V[,R^*^Jz)~?/vuf6i9?>3'l[Fi-nB
2024-08-25 22:30:33 UTC	13746	IN	Data Raw: e4 77 20 51 14 c9 47 07 d1 c7 69 2d 1e 15 1d 3e f3 a5 77 97 45 ff f7 33 dc 5f 74 7b b0 96 ae f7 5e 5b 18 f7 5e e3 3d d2 27 d3 88 43 29 0a 09 fa 6b 8c 6c 8b 40 40 db 69 f2 7a 1c 85 c6 0a 00 2c 1d 87 81 11 3d 16 21 be 75 ab 34 55 f2 2a 7a b0 25 13 e3 03 57 fd 6e 0c 6e 15 ce 1f d0 4d 55 05 4b f5 05 7b 37 55 e0 dd 54 6f 43 ba 20 94 a2 23 8d b7 c3 5b 8d 1d 09 d4 42 15 0c b6 56 20 56 10 01 d2 45 11 4c 02 c5 97 00 2b a5 74 a3 91 40 4e db 6b d6 91 19 4f 2e c6 31 3e fd 17 e2 23 78 17 44 0f fd fb e1 13 58 b8 d3 1f 1d 8d fa a3 23 de 1f fd 96 48 ab c7 bf 8d b4 dd f9 a5 b1 13 6b 14 84 48 41 06 83 f5 92 61 f5 71 21 5f 50 81 b1 53 00 40 5b c7 a5 58 fa b8 84 9c 8e c0 52 44 4f 9e 8c e3 3c 02 2e 88 0e a8 2a 23 87 bb 2d 19 38 8e 68 8d 62 be 21 80 41 a2 34 03 20 14 d3 63 d1 Data Ascii: w QGi->wE3_t{^[^='C)kl@@iz,=!u4Uz%WnnMUK{7UToC #[BV VEL+t@NkO.1>#xDX#HkHAaq!_PS@[XRDO<.#-8hb!A4 c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49738	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:32 UTC	578	OUT	GET /generate-qrcode HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	1182	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6InBVSVNZN00rN201ck4zWTNIdWFKRUE9PSIsInZhbHVlIjoic2hmd2dRS0t5cUhVTkl0czNIc2hSbG9oTFcyUEhFdHV1Uyt6NDh0Q1JSWlBlaFRBMFRQL2tsVElvMjZLTFZ4aEQ4Q1ZSN2R0dlVydGlqNWJySHpSOGZlVFVObzRaenNISWRTcEJITGJrbWNCTzJmU0JPK3ZySjRra2VOdGluMFIiLCJtYWMiOiJkOGMyOTJkOTdkNWJlMGUzM2ZlNDZkYTEzMzdlMWM2NDEyMmIyYTA3OWQ1OTRkMmRhZGE1ZDdkYzJhN2QzZDQwIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:33 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6IktiTGVPb3NjY3dkcCtJREVUT1hTZ2c9PSIsInZhbHVlIjoiQWxTYjdCOWNjUkdnMmNlVXd4OC9vZGxHYlVBOTFWMk5JMHRKN28vRmJXVTFaWjJsN1J1UkZXWm9OblFpTGFYc3VnUElxRjlaeWhuQ1VoK08ydUJsOHBxOG9BdlFWZU14bFNCb2VNTDVYMlpwYkN6TElWdjRISmZHOHlDMERuR3MiLCJtYWMiOiJlZWI4MzRlY2U2YzY5MjgzNDM4ZDhiZDhhZDc3OGI2YmUyZGU5OWZkMTA4ZDMyZmUwYzAxNWNhZjEzMzEzNWQxIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:33 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-25 22:30:33 UTC	415	IN	Data Raw: 31 39 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 01 00 00 00 00 85 23 93 33 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 01 dd 8a 13 a4 00 00 01 20 49 44 41 54 58 c3 dd 98 41 16 83 30 08 44 b9 39 47 a7 46 02 33 68 dc 43 f3 ac be f6 c7 05 81 0c 93 8a f8 50 51 bb 2e bb 6e 52 c7 58 b2 ee 85 ac 89 f7 f4 24 fe 4b 73 b2 a3 51 0f 2b 22 2b 44 63 29 06 91 4c ca 9b a8 50 ee 66 91 73 3c f6 1f 64 d7 e8 de 71 fe 29 d5 db 91 84 1e 50 3d be 94 62 22 11 d6 85 35 2c 86 27 6f af c0 fa de 99 a0 c6 b0 b9 32 3e 27 a9 e2 53 08 69 75 90 cc 96 e1 11 45 db 9b 64 34 8a 24 dd 53 ac 88 a1 9a c4 6b dd 89 48 b1 06 91 24 83 49 d8 8d d7 Data Ascii: 193PNGIHDR#3 cHRMz&u0`:pQ<bKGD IDATXA0D9GF3hCPQ.nRX$KsQ+"+Dc)LPfs<dq)P=b"5,'o2>'SiuEd4$SkH$I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49739	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:32 UTC	583	OUT	GET /images/app-store.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:03 GMT ETag: "65faaa7f-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49740	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:32 UTC	580	OUT	GET /images/apk-zh.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49742	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:33 UTC	585	OUT	GET /images/google-play.png HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 3103 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-c1f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	3103	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 88 00 00 00 28 08 06 00 00 00 25 a6 b2 bc 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 0b ad 49 44 41 54 78 da ed 9c 07 50 14 c9 1a c7 77 c9 41 cc 39 e7 80 22 e6 f4 4c 9c 09 ef 50 3c b5 cc 96 e1 99 43 a9 04 b5 cc 9e a5 67 4e 18 aa 0c e5 b3 e4 99 73 ce fa cc 98 9e 8a a0 22 7a 26 4c a7 9e 3e b3 32 fc df fc fb ec 71 76 59 10 15 0e 4f e6 ab fa 8a 9d de de 99 de 9e df 74 7f 89 35 99 3e ca 3f 54 dd a2 ea 13 55 61 68 9a d3 97 aa 1e 51 b5 9d c9 86 f4 54 35 d6 98 24 43 3f e8 22 55 cd 12 8e f2 06 1c 86 da d0 ee 12 90 25 c6 64 18 6a 43 2f 4b 40 22 8c c9 30 34 01 f5 20 20 37 8d 89 30 34 01 cd f3 b7 02 24 7b f6 ec f0 f5 f5 45 a6 4c 99 b4 b6 ac 59 b3 a2 78 f1 e2 9a 7a 78 78 58 1c 17 2d 5a 54 eb eb Data Ascii: PNGIHDR(%bKGDIDATxPwA9"LP<CgNs"z&L>2qvYOt5>?TUahQT5$C?"U%djC/K@"04 704${ELYxzxxX-ZT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49743	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:33 UTC	348	OUT	GET /images/menu.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 198 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:10 GMT ETag: "65faaa86-c6" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 1a 04 03 00 00 00 5b 64 51 fd 00 00 00 18 50 4c 54 45 00 00 00 36 3b 4e 36 3d 4c 36 3c 4d 36 3c 4d 36 3c 4d 36 3c 4d ff ff ff e0 ca aa 6c 00 00 00 06 74 52 4e 53 00 6c 75 77 88 e1 1b 6c 73 0b 00 00 00 01 62 4b 47 44 07 16 61 88 eb 00 00 00 23 49 44 41 54 18 d3 63 60 a0 0e 60 4d 83 81 00 06 da 00 46 63 18 10 00 f2 98 5c 60 40 81 46 f6 51 df 47 00 a9 3f 0c 39 db d5 8b 93 00 00 00 00 49 45 4e 44 ae 42 60 82 5b 5b 2a 41 54 2a 5d 38 30 30 46 46 44 43 31 44 30 32 46 34 36 43 41 38 31 35 32 46 41 30 31 32 39 44 31 37 45 41 30 Data Ascii: PNGIHDR[dQPLTE6;N6=L6<M6<M6<M6<MltRNSluwlsbKGDa#IDATc``MFc\`@FQG?9IENDB`[[AT]800FFDC1D02F46CA8152FA0129D17EA0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49744	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:33 UTC	349	OUT	GET /images/alarm.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:33 UTC	271	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:33 GMT Content-Type: image/png Content-Length: 574 Connection: close Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-23e" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:33 UTC	574	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 cf 50 4c 54 45 00 00 00 80 80 bf 80 aa aa 9f 9f 9f 8e aa aa 8b a2 a2 99 99 aa 92 9e aa 90 9b a6 99 99 a3 97 a1 aa 92 9b a4 91 a2 aa 97 9f a7 95 9d a6 92 9f a7 93 9d a8 94 9e a5 93 9f a6 94 9d a7 93 9e a6 94 9f a7 95 9d a5 94 9e a6 95 9f a7 94 9e a5 95 9e a6 94 9d a7 95 9e a5 94 9f a5 95 9d a6 93 9e a6 94 9e a7 95 9d a5 94 9e a6 95 9f a7 94 9e a6 94 9e a7 93 9d a6 94 9e a6 93 9e a6 94 9d a5 94 9e a5 95 9e a7 94 9e a6 94 9e a6 94 9e a7 94 9e a6 94 9e a5 95 9e a6 94 9e a6 94 9d a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a5 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 94 9e a6 ff ff ff 11 0f 32 85 00 00 00 Data Ascii: PNGIHDRPLTE2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49708	188.114.97.3	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:33 UTC	572	OUT	GET /favicon.ico HTTP/1.1 Host: im16.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im16.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:34 UTC	596	IN	HTTP/1.1 404 Not Found Date: Sun, 25 Aug 2024 22:30:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8b8f06fd0a8841e0-EWR alt-svc: h3=":443"; ma=86400
2024-08-25 22:30:34 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-08-25 22:30:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49747	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:34 UTC	352	OUT	GET /images/ewm_icon.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:34 UTC	296	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:34 GMT Content-Type: image/png Content-Length: 5040 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-13b0" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:34 UTC	5040	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 13 50 49 44 41 54 78 5e ed 9d 5d 72 13 c7 16 c7 4f 0f 15 ee 7d bb dc 15 c4 54 85 19 bf c5 3c 58 e4 0d bc 82 98 15 10 af 20 66 05 38 2b 08 ac 00 b3 82 98 15 60 bf 81 fc 10 f1 26 8d 53 15 79 05 31 6f 68 1c cf b9 d5 f2 28 e8 62 6b fa f4 c7 8c 7a a4 ff 54 a5 52 94 fb f3 7f fa d7 a7 bf d4 ad 08 1f 14 80 02 0b 15 50 d0 06 0a 40 81 c5 0a 00 10 b4 0e 28 50 a3 00 00 41 f3 80 02 00 04 6d 00 0a b8 29 00 0f e2 a6 1b 62 ad 89 02 00 64 4d 0c 8d 6a ba 29 00 40 dc 74 43 ac 35 51 00 80 ac 89 a1 51 4d 37 05 00 88 9b 6e 88 b5 26 0a 00 90 35 31 34 aa e9 a6 00 00 71 d3 0d b1 d6 44 81 c6 00 d9 dc fc 61 83 fe be fa 56 eb 58 26 ea c9 aa e8 a9 94 1a a8 ab f2 e2 4a d1 a7 b3 b3 Data Ascii: PNGIHDRXPIDATx^]rO}T<X f8+`&Sy1oh(bkzTRP@(PAm)bdMj)@tC5QQM7n&514qDaVX&J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49746	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:34 UTC	350	OUT	GET /images/apk-zh.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:34 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:34 GMT Content-Type: image/png Content-Length: 2668 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:02 GMT ETag: "65faaa7e-a6c" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:34 UTC	2668	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 06 00 00 00 3f 9a 52 32 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 09 fa 49 44 41 54 78 da ed 5c 67 50 15 59 16 26 67 09 92 51 10 14 10 90 2c 23 a2 ab 2e 23 82 5b 28 2a 8e 8a 5a 86 35 a1 b8 18 d7 35 8b 98 09 a3 e8 62 60 08 8e ba 06 cc 3a a6 d5 c5 9c 73 5a 63 99 ca b0 86 52 57 2d 7f ed 4c 9d 7d df 91 6e bb 1f 2f a0 08 94 63 bf aa af de eb db dd b7 bb ef f9 4e bc f7 b5 81 81 fc d3 54 85 5c 15 2e aa f0 1f 15 7e 55 81 14 fc ae f0 6b b9 6c 2f a8 90 53 2e f3 0a 1f 73 15 e6 ab f0 9b 32 60 df 1c 7e 2b 97 bd 99 94 10 ab 95 81 f9 e6 91 2f 90 21 56 19 0c 05 e5 68 03 42 94 28 03 a1 a0 1c c5 20 c4 0d 65 20 14 94 e3 3a 08 f1 5f 65 20 14 94 03 5c 50 32 0b 05 b2 94 b4 f6 6f c4 d3 Data Ascii: PNGIHDR(?R2bKGDIDATx\gPY&gQ,#.#[(*Z55b`:sZcRW-L}n/cNT\.~Ukl/S.s2`~+/!VhB( e :_e \P2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49745	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:34 UTC	353	OUT	GET /images/app-store.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:34 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:34 GMT Content-Type: image/png Content-Length: 1774 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:03 GMT ETag: "65faaa7f-6ee" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:34 UTC	1774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 28 08 04 00 00 00 95 93 9a b9 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 06 80 49 44 41 54 68 de ed da 7b 90 d6 55 19 c0 f1 67 d7 65 97 e4 22 ac 2c d8 a2 dc 1c b1 4c 44 20 2a c6 4a 4c a5 0c 74 0d c5 74 72 b8 1a 92 d4 b8 92 25 78 69 06 6d b8 e4 85 42 9d 35 33 51 61 43 21 21 f0 52 03 48 8a 06 88 a8 90 89 32 12 b9 a6 30 8b 97 dd d1 1a dc 5c f8 f4 c7 9e 7d 67 17 76 57 c3 25 19 77 cf f9 e7 fd 9d 73 9e e7 f7 fe be ef 79 9f db ef 44 d4 b4 41 71 53 6c 8a 9d 51 1d 5a 48 af 8e 9d f1 7c dc 18 83 22 d3 f2 e2 96 d8 d3 62 00 ec db f7 c4 2d 91 5b 03 a2 b4 c5 42 a8 ed b7 45 44 9c d6 e2 31 08 71 6a c4 dd ad 18 42 fc 36 e2 e5 56 0c 21 5e 8a a8 6c c5 10 a2 32 5a b0 bf a8 ef 4c 5b 21 24 27 7a a0 a2 59 Data Ascii: PNGIHDR(bKGDIDATh{Uge",LD *JLttr%ximB53QaC!!RH20\}gvW%wsyDAqSlQZH\|"b-[BED1qjB6V!^l2ZL[!$'zY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49748	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:34 UTC	348	OUT	GET /generate-qrcode HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:35 UTC	1182	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:35 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6IklpOU53WUpiRFc1d3lsTDE4Q2g0dmc9PSIsInZhbHVlIjoiQ2dVK1dCOHNiTHJHVDVBUzBIUSs3TytDTWZ5emRMeHIxNWRzbUhURDFWSFhxN043UUJucld5UG1YeDBRRlpkRWJRVDgyR3hmV0xDdTdabHQ5TEt1aVMxTlZOV1RQRXlyd28xdmJyQnVyODVKL3N5ajRMUjFybzdGRnorbTlCUnIiLCJtYWMiOiJmYTYyZGM5ODIyYWVkYWIzOWMwMDVmMjk4YmM1YzUzYTIxOTgyOTljZDNmM2Q3MGZlMDEwZjI3YTZlZjIwMjUzIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:35 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6IjJHSWRkSElONWpsNVJZYWc0TjNSU1E9PSIsInZhbHVlIjoiM2pORlh6VVhjclB3dUJoVy9QQkpsbW5sVjFIZU4zRnh0NVFxZTBjRzUrNHpyYjJWcUF3a3NaaytvMDM5MTBwVUU2ckNXaEFKdFV1V3pHNXhUSEljQ0VYbTJTU0RjSjQ2MnJFcFhDUjBpRTBhbEtaTWtycEJiSjBNOVhpMjBWdmUiLCJtYWMiOiJiNzdjOTZmM2I3MGFiZGExZGE4NzM5Y2E2ZTBkYmYyNTk5NzQ0NmQyZDE2MDVkOGFiMThhZDQ0ODJkMzI3NmUxIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:35 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-25 22:30:35 UTC	415	IN	Data Raw: 31 39 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 01 00 00 00 00 85 23 93 33 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 01 dd 8a 13 a4 00 00 01 20 49 44 41 54 58 c3 dd 98 41 16 83 30 08 44 b9 39 47 a7 46 02 33 68 dc 43 f3 ac be f6 c7 05 81 0c 93 8a f8 50 51 bb 2e bb 6e 52 c7 58 b2 ee 85 ac 89 f7 f4 24 fe 4b 73 b2 a3 51 0f 2b 22 2b 44 63 29 06 91 4c ca 9b a8 50 ee 66 91 73 3c f6 1f 64 d7 e8 de 71 fe 29 d5 db 91 84 1e 50 3d be 94 62 22 11 d6 85 35 2c 86 27 6f af c0 fa de 99 a0 c6 b0 b9 32 3e 27 a9 e2 53 08 69 75 90 cc 96 e1 11 45 db 9b 64 34 8a 24 dd 53 ac 88 a1 9a c4 6b dd 89 48 b1 06 91 24 83 49 d8 8d d7 Data Ascii: 193PNGIHDR#3 cHRMz&u0`:pQ<bKGD IDATXA0D9GF3hCPQ.nRX$KsQ+"+Dc)LPfs<dq)P=b"5,'o2>'SiuEd4$SkH$I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49749	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:34 UTC	355	OUT	GET /images/google-play.png HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:35 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:35 GMT Content-Type: image/png Content-Length: 3103 Connection: close Vary: Accept-Encoding Last-Modified: Wed, 20 Mar 2024 09:21:08 GMT ETag: "65faaa84-c1f" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:35 UTC	3103	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 88 00 00 00 28 08 06 00 00 00 25 a6 b2 bc 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 0b ad 49 44 41 54 78 da ed 9c 07 50 14 c9 1a c7 77 c9 41 cc 39 e7 80 22 e6 f4 4c 9c 09 ef 50 3c b5 cc 96 e1 99 43 a9 04 b5 cc 9e a5 67 4e 18 aa 0c e5 b3 e4 99 73 ce fa cc 98 9e 8a a0 22 7a 26 4c a7 9e 3e b3 32 fc df fc fb ec 71 76 59 10 15 0e 4f e6 ab fa 8a 9d de de 99 de 9e df 74 7f 89 35 99 3e ca 3f 54 dd a2 ea 13 55 61 68 9a d3 97 aa 1e 51 b5 9d c9 86 f4 54 35 d6 98 24 43 3f e8 22 55 cd 12 8e f2 06 1c 86 da d0 ee 12 90 25 c6 64 18 6a 43 2f 4b 40 22 8c c9 30 34 01 f5 20 20 37 8d 89 30 34 01 cd f3 b7 02 24 7b f6 ec f0 f5 f5 45 a6 4c 99 b4 b6 ac 59 b3 a2 78 f1 e2 9a 7a 78 78 58 1c 17 2d 5a 54 eb eb Data Ascii: PNGIHDR(%bKGDIDATxPwA9"LP<CgNs"z&L>2qvYOt5>?TUahQT5$C?"U%djC/K@"04 704${ELYxzxxX-ZT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49752	35.190.80.1	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:35 UTC	529	OUT	OPTIONS /report/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://im16.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:35 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Sun, 25 Aug 2024 22:30:35 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49753	35.190.80.1	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:36 UTC	478	OUT	POST /report/v4?s=B9XmYGwP96b%2FAtU%2BCkLAM1aCcWhLGBN8YhJr%2BBleDVQuMkRMwAjk%2F8%2FvelNQHNcv78j24tCxDCyOsIr1A35NzwrU7xz0mnQ7atZaCA8FPpVVkTu0dosCIPa%2FYA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 407 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-25 22:30:36 UTC	407	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 33 38 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 36 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6d 31 36 2e 6e 65 74 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 37 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a Data Ascii: [{"age":386,"body":{"elapsed_time":566,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://im16.net/","sampling_fraction":1.0,"server_ip":"188.114.97.3","status_code":404,"type":"http.error"},"type":"network-error","url":"https:
2024-08-25 22:30:36 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Sun, 25 Aug 2024 22:30:35 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49757	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-25 22:30:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:40 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30324.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: b00d902c-105c-460a-a060-1de7a5150072 PPServer: PPV: 30 H: SN1PEPF0002F1A8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:39 GMT Connection: close Content-Length: 11389
2024-08-25 22:30:40 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49758	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-25 22:30:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:41 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30324.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: af0bd7f6-ee4f-45fe-8df2-95e217874722 PPServer: PPV: 30 H: SN1PEPF0002F1B0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:40 GMT Connection: close Content-Length: 11389
2024-08-25 22:30:41 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49759	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4710 Host: login.live.com
2024-08-25 22:30:42 UTC	4710	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:42 UTC	656	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=5&213=292991&215=0&315=1&215=0&315=1&214=30&288=16.0.30324.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 64a99bc5-87fc-442d-bc4d-fb543900b2e9 PPServer: PPV: 30 H: SN1PEPF0002F1AC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:42 GMT Connection: close Content-Length: 10173
2024-08-25 22:30:42 UTC	10173	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49760	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-25 22:30:42 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: e680c708-a81f-482f-a1f1-9001445ea19d PPServer: PPV: 30 H: PH1PEPF00011E78 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:41 GMT Connection: close Content-Length: 1918
2024-08-25 22:30:42 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49762	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-25 22:30:43 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30324.2 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 871613d6-d6c4-4276-ae85-dcd8073fa02d PPServer: PPV: 30 H: SN1PEPF0002F1B0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:43 GMT Connection: close Content-Length: 11389
2024-08-25 22:30:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49766	40.126.32.72	443

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-08-25 22:30:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-25 22:30:46 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 25 Aug 2024 22:29:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: e7b2b44e-3048-4925-b5e5-666ba23dc791 PPServer: PPV: 30 H: PH1PEPF000183A6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 25 Aug 2024 22:30:45 GMT Connection: close Content-Length: 11389
2024-08-25 22:30:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49774	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:49 UTC	1368	OUT	GET /download.html HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IklpOU53WUpiRFc1d3lsTDE4Q2g0dmc9PSIsInZhbHVlIjoiQ2dVK1dCOHNiTHJHVDVBUzBIUSs3TytDTWZ5emRMeHIxNWRzbUhURDFWSFhxN043UUJucld5UG1YeDBRRlpkRWJRVDgyR3hmV0xDdTdabHQ5TEt1aVMxTlZOV1RQRXlyd28xdmJyQnVyODVKL3N5ajRMUjFybzdGRnorbTlCUnIiLCJtYWMiOiJmYTYyZGM5ODIyYWVkYWIzOWMwMDVmMjk4YmM1YzUzYTIxOTgyOTljZDNmM2Q3MGZlMDEwZjI3YTZlZjIwMjUzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJHSWRkSElONWpsNVJZYWc0TjNSU1E9PSIsInZhbHVlIjoiM2pORlh6VVhjclB3dUJoVy9QQkpsbW5sVjFIZU4zRnh0NVFxZTBjRzUrNHpyYjJWcUF3a3NaaytvMDM5MTBwVUU2ckNXaEFKdFV1V3pHNXhUSEljQ0VYbTJTU0RjSjQ2MnJFcFhDUjBpRTBhbEtaTWtycEJiSjBNOVhpMjBWdmUiLCJtYWMiOiJiNzdjOTZmM2I3MGFiZGExZGE4NzM5Y2E2ZTBkYmYyNTk5NzQ0NmQyZDE2MDVkOGFiMThhZDQ0ODJkMzI3NmUxIiwidGFnIjoiIn0%3D
2024-08-25 22:30:49 UTC	1197	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: XSRF-TOKEN=eyJpdiI6Im1RSHFMUkFJZGI2R0w3RGtkM0M5L1E9PSIsInZhbHVlIjoiN3Fqc0pIdm9yWDdKcGFtUmgyT1pkSWRoVTFWanZ0Zmh2ZEpDdDdBblUrSEtReWFINER5SStuODl1d0grUTBnek5lNU95cTR1akNsQUErR1JzWWZQL1Zya0ZBZVowRGRhRjNWaEUzdWc5dXFLejkzcEprZzVHdHY5QzFtWGtCTzUiLCJtYWMiOiI0N2EwNGJjYjM5MWZhZWJiNmQ4NjI0YTU4OWFjYzdkN2VmMjRhMmU3YmIxODI1NjcxYTE4Yzg1YjE5Zjg2NmNkIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:49 GMT; Max-Age=7200; path=/; samesite=lax Set-Cookie: laravel_session=eyJpdiI6Ik11YmF1TERqQklNcnhFMVZiWUdwcnc9PSIsInZhbHVlIjoiZVhmRkhjOWc0RDlaM2JyVlFGbjB2RGlhS1ByS2ZOTTZiQTdZSXZ5d21vRC9XK0NINmRiM1ZwU1c0OGN1cWVud0lhRm9QWEFiaWIvMEk3WmRFS1d0aHkyUTYvdXdvL2craisrMmpDOFpXNWJWZzlMWngzdEk4bHBhb0hLaHQ5a2MiLCJtYWMiOiJmZGQxNzNlOGIyMTcxZDg5OTc4ZDM2ZjBkODU5YTg2NGQxZWExNjQzNWY4OTY3OWVkZjYzMGNkMWFhZThhMzlhIiwidGFnIjoiIn0%3D; expires=Mon, 26 Aug 2024 00:30:49 GMT; Max-Age=7200; path=/; httponly; samesite=lax Strict-Transport-Security: max-age=31536000
2024-08-25 22:30:49 UTC	428	IN	Data Raw: 31 61 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 bd 91 e7 ab 99 e5 bb ba e8 ae be e4 b8 ad 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e Data Ascii: 1a0<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <title></title> <lin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49773	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:51 UTC	1310	OUT	GET /favicon.ico HTTP/1.1 Host: im144.mom Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://im144.mom/download.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Im1RSHFMUkFJZGI2R0w3RGtkM0M5L1E9PSIsInZhbHVlIjoiN3Fqc0pIdm9yWDdKcGFtUmgyT1pkSWRoVTFWanZ0Zmh2ZEpDdDdBblUrSEtReWFINER5SStuODl1d0grUTBnek5lNU95cTR1akNsQUErR1JzWWZQL1Zya0ZBZVowRGRhRjNWaEUzdWc5dXFLejkzcEprZzVHdHY5QzFtWGtCTzUiLCJtYWMiOiI0N2EwNGJjYjM5MWZhZWJiNmQ4NjI0YTU4OWFjYzdkN2VmMjRhMmU3YmIxODI1NjcxYTE4Yzg1YjE5Zjg2NmNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik11YmF1TERqQklNcnhFMVZiWUdwcnc9PSIsInZhbHVlIjoiZVhmRkhjOWc0RDlaM2JyVlFGbjB2RGlhS1ByS2ZOTTZiQTdZSXZ5d21vRC9XK0NINmRiM1ZwU1c0OGN1cWVud0lhRm9QWEFiaWIvMEk3WmRFS1d0aHkyUTYvdXdvL2craisrMmpDOFpXNWJWZzlMWngzdEk4bHBhb0hLaHQ5a2MiLCJtYWMiOiJmZGQxNzNlOGIyMTcxZDg5OTc4ZDM2ZjBkODU5YTg2NGQxZWExNjQzNWY4OTY3OWVkZjYzMGNkMWFhZThhMzlhIiwidGFnIjoiIn0%3D
2024-08-25 22:30:51 UTC	276	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:51 GMT Content-Type: image/x-icon Content-Length: 4286 Connection: close Last-Modified: Sun, 31 Mar 2024 05:56:56 GMT ETag: "6608fb28-10be" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:51 UTC	4286	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 b0 69 01 00 ad 88 02 00 b0 69 01 0f b0 6a 02 41 b0 6b 02 86 b1 6c 02 ba b1 6e 02 dd b2 6f 02 ef b2 70 03 f9 b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 77 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 7f 05 ff b8 80 05 ff b9 82 05 ff b9 83 06 ff ba 85 06 fe ba 86 06 fc bb 88 07 f7 bc 8a 07 ee bc 8b 07 da bd 8d 08 b8 be 8f 08 85 be 90 08 40 be 91 08 0e b4 80 00 00 be 93 08 00 b2 5e 01 00 b0 69 01 13 b0 6a 01 57 b0 6a 01 ae b0 6b 02 e1 b1 6d 02 f1 b2 6f 02 f8 b2 70 02 fc b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 76 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 Data Ascii: ( @ iijAklnoprsuwxz{}@^ijWjkmoprsuvxz{}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49776	8.218.143.165	443	5968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-25 22:30:52 UTC	1067	OUT	GET /favicon.ico HTTP/1.1 Host: im144.mom Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Im1RSHFMUkFJZGI2R0w3RGtkM0M5L1E9PSIsInZhbHVlIjoiN3Fqc0pIdm9yWDdKcGFtUmgyT1pkSWRoVTFWanZ0Zmh2ZEpDdDdBblUrSEtReWFINER5SStuODl1d0grUTBnek5lNU95cTR1akNsQUErR1JzWWZQL1Zya0ZBZVowRGRhRjNWaEUzdWc5dXFLejkzcEprZzVHdHY5QzFtWGtCTzUiLCJtYWMiOiI0N2EwNGJjYjM5MWZhZWJiNmQ4NjI0YTU4OWFjYzdkN2VmMjRhMmU3YmIxODI1NjcxYTE4Yzg1YjE5Zjg2NmNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik11YmF1TERqQklNcnhFMVZiWUdwcnc9PSIsInZhbHVlIjoiZVhmRkhjOWc0RDlaM2JyVlFGbjB2RGlhS1ByS2ZOTTZiQTdZSXZ5d21vRC9XK0NINmRiM1ZwU1c0OGN1cWVud0lhRm9QWEFiaWIvMEk3WmRFS1d0aHkyUTYvdXdvL2craisrMmpDOFpXNWJWZzlMWngzdEk4bHBhb0hLaHQ5a2MiLCJtYWMiOiJmZGQxNzNlOGIyMTcxZDg5OTc4ZDM2ZjBkODU5YTg2NGQxZWExNjQzNWY4OTY3OWVkZjYzMGNkMWFhZThhMzlhIiwidGFnIjoiIn0%3D
2024-08-25 22:30:53 UTC	276	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 25 Aug 2024 22:30:53 GMT Content-Type: image/x-icon Content-Length: 4286 Connection: close Last-Modified: Sun, 31 Mar 2024 05:56:56 GMT ETag: "6608fb28-10be" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-08-25 22:30:53 UTC	4286	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 b0 69 01 00 ad 88 02 00 b0 69 01 0f b0 6a 02 41 b0 6b 02 86 b1 6c 02 ba b1 6e 02 dd b2 6f 02 ef b2 70 03 f9 b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 77 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 7f 05 ff b8 80 05 ff b9 82 05 ff b9 83 06 ff ba 85 06 fe ba 86 06 fc bb 88 07 f7 bc 8a 07 ee bc 8b 07 da bd 8d 08 b8 be 8f 08 85 be 90 08 40 be 91 08 0e b4 80 00 00 be 93 08 00 b2 5e 01 00 b0 69 01 13 b0 6a 01 57 b0 6a 01 ae b0 6b 02 e1 b1 6d 02 f1 b2 6f 02 f8 b2 70 02 fc b3 72 03 fe b3 73 03 ff b4 75 03 ff b5 76 04 ff b5 78 04 ff b6 7a 04 ff b6 7b 04 ff b7 7d 05 ff b7 Data Ascii: ( @ iijAklnoprsuwxz{}@^ijWjkmoprsuvxz{}

Target ID:	0
Start time:	18:30:15
Start date:	25/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:30:18
Start date:	25/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,1885441002382646068,5785783420920561829,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:30:20
Start date:	25/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://im16.net/"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.72

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: im16.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jstz/imdx.js HTTP/1.1Host: tretwq.oss-accelerate.aliyuncs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://im16.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://im16.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /jstz/imdx.js HTTP/1.1Host: tretwq.oss-accelerate.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/swiper.min.css HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ccc8.css HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/111f.css HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdTokenLogo.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdapk.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdpg.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/banner.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/menu.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdTokenLogo.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/alarm.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdapk.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bdpg.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ewm_icon.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/banner.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate-qrcode HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/app-store.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/apk-zh.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/google-play.png HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/menu.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/alarm.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im16.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im16.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ewm_icon.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/apk-zh.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/app-store.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /generate-qrcode HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/google-play.png HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /download.html HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklpOU53WUpiRFc1d3lsTDE4Q2g0dmc9PSIsInZhbHVlIjoiQ2dVK1dCOHNiTHJHVDVBUzBIUSs3TytDTWZ5emRMeHIxNWRzbUhURDFWSFhxN043UUJucld5UG1YeDBRRlpkRWJRVDgyR3hmV0xDdTdabHQ5TEt1aVMxTlZOV1RQRXlyd28xdmJyQnVyODVKL3N5ajRMUjFybzdGRnorbTlCUnIiLCJtYWMiOiJmYTYyZGM5ODIyYWVkYWIzOWMwMDVmMjk4YmM1YzUzYTIxOTgyOTljZDNmM2Q3MGZlMDEwZjI3YTZlZjIwMjUzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJHSWRkSElONWpsNVJZYWc0TjNSU1E9PSIsInZhbHVlIjoiM2pORlh6VVhjclB3dUJoVy9QQkpsbW5sVjFIZU4zRnh0NVFxZTBjRzUrNHpyYjJWcUF3a3NaaytvMDM5MTBwVUU2ckNXaEFKdFV1V3pHNXhUSEljQ0VYbTJTU0RjSjQ2MnJFcFhDUjBpRTBhbEtaTWtycEJiSjBNOVhpMjBWdmUiLCJtYWMiOiJiNzdjOTZmM2I3MGFiZGExZGE4NzM5Y2E2ZTBkYmYyNTk5NzQ0NmQyZDE2MDVkOGFiMThhZDQ0ODJkMzI3NmUxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im144.momConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://im144.mom/download.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im1RSHFMUkFJZGI2R0w3RGtkM0M5L1E9PSIsInZhbHVlIjoiN3Fqc0pIdm9yWDdKcGFtUmgyT1pkSWRoVTFWanZ0Zmh2ZEpDdDdBblUrSEtReWFINER5SStuODl1d0grUTBnek5lNU95cTR1akNsQUErR1JzWWZQL1Zya0ZBZVowRGRhRjNWaEUzdWc5dXFLejkzcEprZzVHdHY5QzFtWGtCTzUiLCJtYWMiOiI0N2EwNGJjYjM5MWZhZWJiNmQ4NjI0YTU4OWFjYzdkN2VmMjRhMmU3YmIxODI1NjcxYTE4Yzg1YjE5Zjg2NmNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik11YmF1TERqQklNcnhFMVZiWUdwcnc9PSIsInZhbHVlIjoiZVhmRkhjOWc0RDlaM2JyVlFGbjB2RGlhS1ByS2ZOTTZiQTdZSXZ5d21vRC9XK0NINmRiM1ZwU1c0OGN1cWVud0lhRm9QWEFiaWIvMEk3WmRFS1d0aHkyUTYvdXdvL2craisrMmpDOFpXNWJWZzlMWngzdEk4bHBhb0hLaHQ5a2MiLCJtYWMiOiJmZGQxNzNlOGIyMTcxZDg5OTc4ZDM2ZjBkODU5YTg2NGQxZWExNjQzNWY4OTY3OWVkZjYzMGNkMWFhZThhMzlhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: im144.momConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im1RSHFMUkFJZGI2R0w3RGtkM0M5L1E9PSIsInZhbHVlIjoiN3Fqc0pIdm9yWDdKcGFtUmgyT1pkSWRoVTFWanZ0Zmh2ZEpDdDdBblUrSEtReWFINER5SStuODl1d0grUTBnek5lNU95cTR1akNsQUErR1JzWWZQL1Zya0ZBZVowRGRhRjNWaEUzdWc5dXFLejkzcEprZzVHdHY5QzFtWGtCTzUiLCJtYWMiOiI0N2EwNGJjYjM5MWZhZWJiNmQ4NjI0YTU4OWFjYzdkN2VmMjRhMmU3YmIxODI1NjcxYTE4Yzg1YjE5Zjg2NmNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik11YmF1TERqQklNcnhFMVZiWUdwcnc9PSIsInZhbHVlIjoiZVhmRkhjOWc0RDlaM2JyVlFGbjB2RGlhS1ByS2ZOTTZiQTdZSXZ5d21vRC9XK0NINmRiM1ZwU1c0OGN1cWVud0lhRm9QWEFiaWIvMEk3WmRFS1d0aHkyUTYvdXdvL2craisrMmpDOFpXNWJWZzlMWngzdEk4bHBhb0hLaHQ5a2MiLCJtYWMiOiJmZGQxNzNlOGIyMTcxZDg5OTc4ZDM2ZjBkODU5YTg2NGQxZWExNjQzNWY4OTY3OWVkZjYzMGNkMWFhZThhMzlhIiwidGFnIjoiIn0%3D

Source: global traffic	DNS traffic detected: DNS query: im16.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tretwq.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: im144.mom
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://im16.net/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Windows Analysis Report
https://im16.net/